@every-app/sdk 0.3.0-rc.1 → 0.3.0-rc.10

package/dist/cloudflare/worker.js

@@ -2,8 +2,13 @@ import { createHash, createHmac } from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import { parseEnv } from "node:util";
-import { DEV_ISSUER, DEV_PUBLIC_KEY_PEM } from "../dev/keypair.js";
-import { sentinelDeployTarget } from "./sentinel.js";
+import { DEV_ISSUER, DEV_ORG_ID, DEV_PUBLIC_KEY_PEM } from "../dev/keypair.js";
+// The catalog's settings, generated from ../internal/capabilities.ts, which
+// this file must not import (see ./index.ts: the Vite plugin hides whatever
+// cloudflare.config.ts imports from the Worker).
+import { DEV_GATEWAY_KEYS } from "./catalogSettings.generated.js";
+import { helperWorkerName, sentinelDeployTarget, workflowNameFor, } from "./sentinel.js";
+export { helperWorkerName, workflowNameFor } from "./sentinel.js";
 /** The names of the manifest's `secrets`, whichever form each took. */
 function manifestSecretNames(manifest) {
     return (manifest.secrets ?? []).map((entry) => typeof entry === "string" ? entry : entry.name);
@@ -12,69 +17,6 @@ function manifestSecretNames(manifest) {
 function manifestProviderIds(manifest) {
     return (manifest.providers ?? []).map((entry) => typeof entry === "string" ? entry : entry.id);
 }
-/**
- * The gateway secrets holding the keys of the AI providers and capabilities
- * an app may ask for, with the settings a provider needs besides its key
- * (Workers AI's account). With no gateway in development, the SDK reaches
- * them with the developer's own values under the same names. A copy of the
- * tables in ../internal, which the Worker loads: the Vite plugin hides
- * whatever cloudflare.config.ts imports from the Worker. A test keeps them
- * in step.
- */
-const DEV_GATEWAY_KEYS = {
-    providers: {
-        openai: ["OPENAI_API_KEY"],
-        openrouter: ["OPENROUTER_API_KEY"],
-        "workers-ai": ["WORKERS_AI_API_TOKEN", "CLOUDFLARE_ACCOUNT_ID"],
-    },
-    capabilities: {
-        dataforseo: ["DATAFORSEO_API_KEY"],
-        context: ["CONTEXT_API_KEY"],
-        // The sender, and the developer's own Email Sending account: set all
-        // but the name and sendEmail() really sends; otherwise it prints.
-        // Resend's key and EMAIL_PROVIDER pick the provider integrationStatus()
-        // names, as the gateway would.
-        // TODO(integration): the last two added by the email-providers lane
-        // (this file is outside its ownership list).
-        email: [
-            "EMAIL_FROM",
-            "EMAIL_FROM_NAME",
-            "EMAIL_REST_API_TOKEN",
-            "CLOUDFLARE_ACCOUNT_ID",
-            "RESEND_API_KEY",
-            "EMAIL_PROVIDER",
-        ],
-        // The organization's members: nothing to set; listMembers() answers
-        // from the dev identity.
-        members: [],
-        // OAuth clients: the id, the secret, and the instance a provider with
-        // no fixed host is on.
-        linkedin: ["LINKEDIN_CLIENT_ID", "LINKEDIN_CLIENT_SECRET"],
-        facebook: ["FACEBOOK_APP_ID", "FACEBOOK_APP_SECRET"],
-        instagram: ["INSTAGRAM_APP_ID", "INSTAGRAM_APP_SECRET"],
-        threads: ["THREADS_APP_ID", "THREADS_APP_SECRET"],
-        youtube: ["YOUTUBE_CLIENT_ID", "YOUTUBE_CLIENT_SECRET"],
-        tiktok: ["TIKTOK_CLIENT_ID", "TIKTOK_CLIENT_SECRET"],
-        "tiktok-business": [
-            "TIKTOK_BUSINESS_CLIENT_ID",
-            "TIKTOK_BUSINESS_CLIENT_SECRET",
-        ],
-        reddit: ["REDDIT_CLIENT_ID", "REDDIT_CLIENT_SECRET"],
-        pinterest: ["PINTEREST_CLIENT_ID", "PINTEREST_CLIENT_SECRET"],
-        discord: ["DISCORD_CLIENT_ID", "DISCORD_CLIENT_SECRET"],
-        slack: ["SLACK_CLIENT_ID", "SLACK_CLIENT_SECRET"],
-        mastodon: ["MASTODON_CLIENT_ID", "MASTODON_CLIENT_SECRET", "MASTODON_URL"],
-        kick: ["KICK_CLIENT_ID", "KICK_CLIENT_SECRET"],
-        twitch: ["TWITCH_CLIENT_ID", "TWITCH_CLIENT_SECRET"],
-        tumblr: ["TUMBLR_CLIENT_ID", "TUMBLR_CLIENT_SECRET"],
-        dribbble: ["DRIBBBLE_CLIENT_ID", "DRIBBBLE_CLIENT_SECRET"],
-        "google-workspace": [
-            "GOOGLE_WORKSPACE_CLIENT_ID",
-            "GOOGLE_WORKSPACE_CLIENT_SECRET",
-        ],
-        "microsoft-365": ["MICROSOFT_365_CLIENT_ID", "MICROSOFT_365_CLIENT_SECRET"],
-    },
-};
 /**
  * Observability every Every App Worker ships with: logs (with invocation
  * logs), sampled traces and Workers Issues, with query strings redacted so
@@ -104,6 +46,19 @@ const BUILD_ENV = "EVERYAPP_BUILD";
 const RESERVED_SECRET_NAME = /^(GATEWAY_URL|CF_VERSION_METADATA|EVERYAPP_\w*|EVERY_APP_\w*|APP__\w*)$/i;
 const GATEWAY_WORKER_NAME = "every-app-gateway";
 const GATEWAY_ENTRYPOINT = "AppGateway";
+/**
+ * Where `everyapp dev` serves its launcher, which it passes to the app's dev
+ * server in EVERYAPP_DEV_GATEWAY_URL; its default address otherwise. The
+ * deployed Worker gets the Gateway's URL from the deploy instead.
+ */
+const DEV_GATEWAY_URL_ENV = "EVERYAPP_DEV_GATEWAY_URL";
+const DEFAULT_DEV_GATEWAY_URL = "http://localhost:8787";
+function devGatewayUrl() {
+    return {
+        type: "text",
+        value: process.env[DEV_GATEWAY_URL_ENV] || DEFAULT_DEV_GATEWAY_URL,
+    };
+}
 /**
  * The manifest's `capabilities` as the SDK's local-dev twin of the gateway
  * reads them: with no gateway to hold an OAuth client's calls to the scope
@@ -115,9 +70,12 @@ function devCapabilities(manifest) {
 /**
  * The binding the dev Worker gets the specs of providers registered on a
  * gateway in (`DEV_PROVIDERS_ENV` in ../internal/devProviders.ts; a copy,
- * kept in step by a test, for the reason {@link DEV_GATEWAY_KEYS} is one).
+ * kept in step by a test, since this file may not import ../internal).
  */
 const DEV_PROVIDERS_ENV = "EVERYAPP_DEV_PROVIDERS";
+/** Linked dev's env names (`LINKED_DEV_URL_ENV`, `LINKED_DEV_NONCE_ENV` in ../internal/protocol.ts; copies, kept in step by the same test). */
+const LINKED_DEV_URL_ENV = "EVERYAPP_LINKED_DEV_URL";
+const LINKED_DEV_NONCE_ENV = "EVERYAPP_LINKED_DEV_NONCE";
 /**
  * The specs `everyapp provider add` (in an app directory) and `everyapp
  * provider show <id> --save` wrote under the app, in name order; none
@@ -148,6 +106,22 @@ function devProviderFiles(root) {
         return { file: `.everyapp/providers/${name}`, spec };
     });
 }
+/**
+ * Linked dev (`everyapp dev --gateway`, docs/design/linked-dev.md): the
+ * gateway-lite starts the app's dev server with the forwarder's loopback
+ * URL and the run's nonce in the process environment; the dev Worker gets
+ * both as text, and the SDK's `gatewayBinding()` builds the shim from
+ * them in place of the missing service binding. Absent in every other
+ * run, and never in a deploy.
+ */
+function addLinkedDev(env) {
+    const url = process.env[LINKED_DEV_URL_ENV]?.trim();
+    const nonce = process.env[LINKED_DEV_NONCE_ENV];
+    if (!url || !nonce)
+        return;
+    env[LINKED_DEV_URL_ENV] = { type: "text", value: url };
+    env[LINKED_DEV_NONCE_ENV] = { type: "text", value: nonce };
+}
 /** EVERYAPP_DEV_PROVIDERS, when the app has any spec files. */
 function addDevProviders(env, root) {
     const files = devProviderFiles(root);
@@ -194,8 +168,14 @@ function devProviderKeys(manifest, root) {
 }
 /** Cloudflare's limit on a Workflow's name. */
 const MAX_WORKFLOW_NAME_LENGTH = 64;
+/**
+ * The store development binds Secrets Store secrets in: Miniflare keeps
+ * one per id under `.cloudflare/state`, and any id works locally.
+ */
+const LOCAL_SECRETS_STORE_ID = "local";
+/** Cloudflare's limit on a Vectorize index's name. */
+const MAX_VECTORIZE_NAME_LENGTH = 64;
 /** Cloudflare's limit on a Worker's name. */
-const MAX_WORKER_NAME_LENGTH = 63;
 /**
  * Where a developer puts a local Postgres URL for a Hyperdrive binding
  * (`.dev.vars` or `.env`), the variable wrangler reads for the same.
@@ -222,6 +202,12 @@ export function everyAppWorker(options) {
     const { deploy, name } = appWorkerName(options, "everyAppWorker");
     const env = {
         EVERYAPP_APP_ID: { type: "text", value: manifest.id },
+        // The manifest itself, for a page that shows what the app asked for:
+        // the Worker can't import everyapp.config.ts (see ./index.ts).
+        EVERYAPP_MANIFEST: {
+            type: "json",
+            value: manifest,
+        },
         CF_VERSION_METADATA: { type: "version-metadata" },
     };
     if (deploy) {
@@ -248,9 +234,24 @@ export function everyAppWorker(options) {
             value: JSON.stringify([DEV_PUBLIC_KEY_PEM]),
         };
         env["EVERYAPP_IDENTITY_ISSUER"] = { type: "text", value: DEV_ISSUER };
+        env["GATEWAY_URL"] = devGatewayUrl();
+        // The stub gateway's organization, as the deploy's secret would be, so
+        // background work's withOrganization(env.EVERY_APP_ORG_ID, …) runs
+        // here too. Not a pin: under the dev opt-in everyApp() enforces none,
+        // so `everyapp dev --mode mirror`'s real organizations still open.
+        env["EVERY_APP_ORG_ID"] = { type: "text", value: DEV_ORG_ID };
         addDevProviders(env, options.root);
+        addLinkedDev(env);
     }
     Object.assign(env, storageBindings(manifest, name, deploy));
+    addQueueBindings(env, manifest, name, deploy);
+    addAiBindings(env, manifest, deploy);
+    addBrowserBindings(env, manifest);
+    addImagesBindings(env, manifest);
+    addAiGatewayBindings(env, manifest, name, deploy);
+    addSendEmailBindings(env, manifest);
+    addSecretsStoreBindings(env, manifest, name, deploy);
+    addAnalyticsEngineBindings(env, manifest, name);
     addDatabaseBindings(env, options, name, undefined, deploy);
     // The app binds every class, a helper Worker's in that Worker, and
     // exports only its own.
@@ -268,13 +269,19 @@ export function everyAppWorker(options) {
         };
     }
     addSecrets(env, options, deploy);
-    const triggers = cronTriggers(options.crons);
+    const triggers = [
+        ...cronTriggers(options.crons),
+        ...queueTriggers(manifest, name, undefined, deploy),
+    ];
     const compatibilityDate = manifest.compatibilityDate ?? DEFAULT_COMPATIBILITY_DATE;
     // cf types a Durable Object namespace with its class only when the binding
     // names the defining Worker by a definition whose module it can read, so
     // the classes this Worker defines name it that way; cf resolves the
     // reference to the Worker's name. A path entrypoint gives cf no module.
+    // Only here: `EveryAppBinding` names Workers by name, as the Vite
+    // plugin's `auxiliaryWorkers` require.
     const { entrypoint } = options;
+    const ownClasses = {};
     if (typeof entrypoint === "object") {
         const self = {
             name,
@@ -284,7 +291,7 @@ export function everyAppWorker(options) {
         for (const durableObject of manifest.resources?.durableObjects ?? []) {
             if (durableObject.worker !== undefined)
                 continue;
-            env[durableObject.name] = {
+            ownClasses[durableObject.name] = {
                 type: "durable-object",
                 worker: self,
                 exportName: durableObject.className,
@@ -301,7 +308,8 @@ export function everyAppWorker(options) {
         ...(triggers.length ? { triggers } : {}),
         ...runtimeSettings(manifest, manifest.limits, deploy),
         observability: observability(),
-        env: env,
+        // Each class keeps its key's place in `env`: classBindings bound it by name.
+        env: { ...env, ...ownClasses },
         exports: exports,
     };
 }
@@ -309,7 +317,10 @@ export function everyAppWorker(options) {
  * Build the definition of one of the app's helper Workers (the manifest's
  * `workers`), e.g. one that runs a memory-hungry job away from the app's
  * Worker. It is named `<app worker>--<worker>`, is private like the app, and
- * binds the app's D1 databases, KV namespaces and R2 buckets, the classes it defines, and
+ * binds the app's  and Analytics Engine datasets, the classes it defines, and
+ * binds the app's D1 databases, KV namespaces, R2 buckets, Workers AI,
+ * Browser Rendering, Images, Vectorize indexes, AI Gateways, `send_email`
+ * bindings and Secrets Store secrets, the classes it defines, and
  * the gateway (with the app's identity, for capabilities). Only the app's
  * Worker reaches it. Pass it to the Vite plugin:
  *
@@ -331,6 +342,8 @@ export function everyAppAuxiliaryWorker(options) {
         EVERYAPP_APP_ID: { type: "text", value: manifest.id },
         ...storageBindings(manifest, appWorker, deploy),
     };
+    addQueueBindings(env, manifest, appWorker, deploy);
+    addSendEmailBindings(env, manifest);
     if (deploy) {
         // The app's identity: the gateway treats its helper Workers as the app.
         env["EVERY_APP_GATEWAY"] = gatewayBinding(deploy, manifest.id, appWorker);
@@ -342,13 +355,25 @@ export function everyAppAuxiliaryWorker(options) {
     else {
         env["EVERYAPP_DEV"] = { type: "text", value: "1" };
         env["EVERYAPP_DEV_CAPABILITIES"] = devCapabilities(manifest);
+        env["GATEWAY_URL"] = devGatewayUrl();
+        env["EVERY_APP_ORG_ID"] = { type: "text", value: DEV_ORG_ID };
         addDevProviders(env, options.root);
+        addLinkedDev(env);
     }
+    addAiBindings(env, manifest, deploy);
+    addBrowserBindings(env, manifest);
+    addImagesBindings(env, manifest);
+    addAiGatewayBindings(env, manifest, appWorker, deploy);
+    addSecretsStoreBindings(env, manifest, appWorker, deploy);
+    addAnalyticsEngineBindings(env, manifest, appWorker);
     addDatabaseBindings(env, options, appWorker, worker, deploy);
     const { bindings, exports } = classBindings(manifest, appWorker, worker, env);
     Object.assign(env, bindings);
     addSecrets(env, options, deploy);
-    const triggers = cronTriggers(options.crons);
+    const triggers = [
+        ...cronTriggers(options.crons),
+        ...queueTriggers(manifest, appWorker, worker, deploy),
+    ];
     return {
         name,
         entrypoint: options.entrypoint,
@@ -363,18 +388,6 @@ export function everyAppAuxiliaryWorker(options) {
         exports,
     };
 }
-/**
- * A helper Worker's name: `<app worker>--<name>`, within Cloudflare's
- * limit. New app ids can't contain `--`, so it is never another app's
- * Worker name.
- */
-export function helperWorkerName(appWorker, helper) {
-    const name = `${appWorker}--${helper}`;
-    if (name.length > MAX_WORKER_NAME_LENGTH) {
-        throw new Error(`Helper Worker ${name} is longer than Cloudflare's ${MAX_WORKER_NAME_LENGTH} characters; shorten its name in everyapp.config.ts.`);
-    }
-    return name;
-}
 /** The placeholder target (in production) and the app Worker's name. */
 function appWorkerName(options, builder) {
     const { manifest, ctx } = options;
@@ -382,7 +395,7 @@ function appWorkerName(options, builder) {
     let deploy;
     if (ctx.mode === "production") {
         if (process.env[BUILD_ENV] !== "1") {
-            throw new Error(`Every App Workers are built for production only by \`everyapp deploy\` (\`pnpm run deploy\`), which sets ${BUILD_ENV}=1 and installs the build: ` +
+            throw new Error(`EveryApp Workers are built for production only by \`everyapp deploy\` (\`pnpm run deploy\`), which sets ${BUILD_ENV}=1 and installs the build: ` +
                 "a bare `cf build` or `cf deploy` would ship a Worker whose name, identity keys, gateway binding and resources are placeholders. " +
                 "For a local build, run Vite in development mode (`vite build --mode development`).");
         }
@@ -410,8 +423,8 @@ function gatewayBinding(deploy, appId, appWorker) {
     };
 }
 /**
- * The app's D1 databases, KV namespaces and R2 buckets, which all its
- * Workers share.
+ * The app's D1 databases, KV namespaces, R2 buckets and Vectorize indexes,
+ * which all its Workers share.
  */
 function storageBindings(manifest, appWorker, deploy) {
     const env = {};
@@ -461,8 +474,237 @@ function storageBindings(manifest, appWorker, deploy) {
             env[binding] = { type: "r2", name: bucketNameFor(appWorker, binding) };
         }
     }
+    // Deployed, the index the deploy provisioned (a placeholder until
+    // installed); in development the account's index of the dev Worker's
+    // name, reached remotely: Cloudflare has no local Vectorize, so calls
+    // throw until the Vite plugin's remoteBindings is on.
+    for (const { name: binding } of manifest.resources?.vectorize ?? []) {
+        if (env[binding]) {
+            throw new Error(`vectorize: ${binding} reuses a binding name the Worker already has.`);
+        }
+        if (deploy) {
+            env[binding] = {
+                type: "vectorize",
+                name: provisioned(deploy.resources.vectorize, binding).name,
+            };
+            continue;
+        }
+        const index = suffixedName(appWorker, binding);
+        if (index.length > MAX_VECTORIZE_NAME_LENGTH) {
+            throw new Error(`vectorize: ${binding} would be the Vectorize index "${index}", longer than Cloudflare's ${MAX_VECTORIZE_NAME_LENGTH} characters; shorten the binding name.`);
+        }
+        env[binding] = { type: "vectorize", name: index, dev: { remote: true } };
+    }
     return env;
 }
+/**
+ * A producer binding to each of the app's queues, which every one of its
+ * Workers gets. Deployed, each names the queue the deploy provisioned (a
+ * placeholder until installed); in development, the queue its rule gives
+ * (Miniflare makes it, shared by the Workers of one `cf dev`).
+ */
+function addQueueBindings(env, manifest, appWorker, deploy) {
+    for (const { name: binding } of manifest.resources?.queues ?? []) {
+        if (env[binding]) {
+            throw new Error(`queues: ${binding} reuses a binding name the Worker already has.`);
+        }
+        env[binding] = {
+            type: "queue",
+            name: queueName(appWorker, binding, deploy),
+        };
+    }
+}
+/**
+ * The manifest's Workers AI bindings, which every one of the app's Workers
+ * gets: `{ type: "ai" }` deployed (account-wide, nothing to provision), and
+ * marked remote in development, where Miniflare has no Workers AI. The
+ * remote mark does nothing until the app's Vite config sets
+ * `remoteBindings: true`, so turning that on is the one switch.
+ */
+function addAiBindings(env, manifest, deploy) {
+    for (const binding of manifest.resources?.ai ?? []) {
+        if (env[binding]) {
+            throw new Error(`ai: ${binding} reuses a binding name the Worker already has.`);
+        }
+        env[binding] = deploy
+            ? { type: "ai" }
+            : { type: "ai", dev: { remote: true } };
+    }
+}
+/**
+ * The consumer triggers of one of the app's Workers: each queue whose
+ * `consumer` is this Worker (`true`, or no `worker`, for the app's own;
+ * `forWorker` for a helper), with its settings and its dead-letter queue,
+ * another of the app's queues, by name.
+ */
+function queueTriggers(manifest, appWorker, forWorker, deploy) {
+    const triggers = [];
+    for (const queue of manifest.resources?.queues ?? []) {
+        if (queue.consumer === undefined)
+            continue;
+        const settings = queue.consumer === true ? {} : queue.consumer;
+        if (settings.worker !== forWorker)
+            continue;
+        const { deadLetterQueue } = settings;
+        if (deadLetterQueue !== undefined &&
+            !manifest.resources?.queues?.some((other) => other.name === deadLetterQueue)) {
+            throw new Error(`queues: ${queue.name}'s deadLetterQueue "${deadLetterQueue}" isn't one of resources.queues.`);
+        }
+        triggers.push({
+            type: "queue",
+            name: queueName(appWorker, queue.name, deploy),
+            ...(deadLetterQueue !== undefined
+                ? { deadLetterQueue: queueName(appWorker, deadLetterQueue, deploy) }
+                : {}),
+            ...Object.fromEntries(QUEUE_CONSUMER_SETTINGS.flatMap((key) => settings[key] === undefined ? [] : [[key, settings[key]]])),
+        });
+    }
+    return triggers;
+}
+/** The consumer settings a queue trigger carries, in the order it lists them. */
+const QUEUE_CONSUMER_SETTINGS = [
+    "maxBatchSize",
+    "maxBatchTimeout",
+    "maxRetries",
+    "maxConcurrency",
+    "retryDelay",
+    "visibilityTimeoutMs",
+];
+/** A queue binding's queue: the deploy's placeholder, or in development its rule. */
+function queueName(appWorker, binding, deploy) {
+    return deploy
+        ? provisioned(deploy.resources.queues, binding).name
+        : queueNameFor(appWorker, binding);
+}
+/**
+ * The manifest's Browser Rendering bindings, which every one of the app's
+ * Workers gets: `{ type: "browser" }` in both modes (account-wide,
+ * nothing to provision; Miniflare serves a local browser in development).
+ */
+function addBrowserBindings(env, manifest) {
+    for (const binding of manifest.resources?.browser ?? []) {
+        if (env[binding]) {
+            throw new Error(`browser: ${binding} reuses a binding name the Worker already has.`);
+        }
+        env[binding] = { type: "browser" };
+    }
+}
+/**
+ * The manifest's Images bindings, which every one of the app's Workers
+ * gets: `{ type: "images" }` in both modes (account-wide, nothing to
+ * provision; Miniflare answers it locally in development).
+ */
+function addImagesBindings(env, manifest) {
+    for (const binding of manifest.resources?.images ?? []) {
+        if (env[binding]) {
+            throw new Error(`images: ${binding} reuses a binding name the Worker already has.`);
+        }
+        env[binding] = { type: "images" };
+    }
+}
+/**
+ * The app's AI Gateways, which all its Workers share, each a `json`
+ * binding of `{ id, accountId, url }`. Deployed, the gateway the deploy
+ * provisioned (a placeholder until installed); in development the id the
+ * deploy's rule gives, with an empty account and URL: there is no gateway,
+ * so the app calls the provider directly.
+ */
+function addAiGatewayBindings(env, manifest, appWorker, deploy) {
+    for (const { name: binding } of manifest.resources?.aiGateway ?? []) {
+        if (env[binding]) {
+            throw new Error(`aiGateway: ${binding} reuses a binding name the Worker already has.`);
+        }
+        const value = deploy
+            ? { ...provisioned(deploy.resources.aiGateway, binding) }
+            : { id: aiGatewayIdFor(appWorker, binding), accountId: "", url: "" };
+        env[binding] = { type: "json", value };
+    }
+}
+/**
+ * The manifest's `send_email` bindings, the same on every one of the
+ * app's Workers in both modes: Cloudflare's binding with the addresses
+ * the manifest lists (the deploy's policy holds the built lists to them).
+ * Deployed, Cloudflare checks a message against them and the account's
+ * Email Sending domains when the Worker sends; in development Miniflare
+ * logs the message and checks the senders.
+ */
+function addSendEmailBindings(env, manifest) {
+    for (const entry of manifest.resources?.sendEmail ?? []) {
+        if (env[entry.name]) {
+            throw new Error(`sendEmail: ${entry.name} reuses a binding name the Worker already has.`);
+        }
+        const senders = entry.allowedSenderAddresses
+            ? { allowedSenderAddresses: [...entry.allowedSenderAddresses] }
+            : {};
+        if (entry.destinationAddress !== undefined &&
+            entry.allowedDestinationAddresses !== undefined) {
+            throw new Error(`sendEmail: ${entry.name} sets both destinationAddress and allowedDestinationAddresses; set one.`);
+        }
+        env[entry.name] =
+            entry.destinationAddress !== undefined
+                ? {
+                    type: "send-email",
+                    ...senders,
+                    destinationAddress: entry.destinationAddress,
+                }
+                : entry.allowedDestinationAddresses !== undefined
+                    ? {
+                        type: "send-email",
+                        ...senders,
+                        allowedDestinationAddresses: [
+                            ...entry.allowedDestinationAddresses,
+                        ],
+                    }
+                    : { type: "send-email", ...senders };
+    }
+}
+/**
+ * The manifest's Secrets Store secrets, which every one of the app's
+ * Workers binds. Deployed, the store and secret the deploy provisioned
+ * (placeholders until installed); in development the local store `local`,
+ * under the name the deploy would give the secret, so a seeded local
+ * secret is named like a deployed one.
+ */
+function addSecretsStoreBindings(env, manifest, appWorker, deploy) {
+    for (const { name: binding } of manifest.resources?.secretsStore ?? []) {
+        if (env[binding]) {
+            throw new Error(`secretsStore: ${binding} reuses a binding name the Worker already has.`);
+        }
+        if (deploy) {
+            const secret = provisioned(deploy.resources.secretsStore, binding);
+            env[binding] = {
+                type: "secrets-store-secret",
+                storeId: secret.storeId,
+                secretName: secret.secretName,
+            };
+        }
+        else {
+            env[binding] = {
+                type: "secrets-store-secret",
+                storeId: LOCAL_SECRETS_STORE_ID,
+                secretName: suffixedName(appWorker, binding),
+            };
+        }
+    }
+}
+/**
+ * The manifest's Analytics Engine datasets, which every one of the app's
+ * Workers writes to: the `dataset` an entry names, or
+ * `<app worker>--<binding>`. Deployed, the app's Worker name is the build's
+ * placeholder, which the install rewrites like every other; a named
+ * dataset holds none and stays as written.
+ */
+function addAnalyticsEngineBindings(env, manifest, appWorker) {
+    for (const entry of manifest.resources?.analyticsEngine ?? []) {
+        if (env[entry.name]) {
+            throw new Error(`analyticsEngine: ${entry.name} reuses a binding name the Worker already has.`);
+        }
+        env[entry.name] = {
+            type: "analytics-engine-dataset",
+            name: entry.dataset ?? suffixedName(appWorker, entry.name),
+        };
+    }
+}
 /**
  * DATABASE_PROVIDER and the Hyperdrive configs one of the app's Workers
  * binds: each config every Worker shares, and those a helper (`forWorker`)
@@ -572,18 +814,25 @@ taken) {
     return { bindings, exports };
 }
 /**
- * Check the names of the manifest's `secrets`, and in dev declare the ones
- * set locally, with the developer's own keys for the manifest's providers
- * and capabilities.
+ * Check the names of the manifest's `secrets` and `settings`, and in dev
+ * declare the ones set locally (a setting that isn't, with its default),
+ * with the developer's own keys for the manifest's providers and
+ * capabilities.
  */
 function addSecrets(env, options, deploy) {
-    const secrets = manifestSecretNames(options.manifest);
+    const settings = options.manifest.settings ?? [];
+    const secrets = [
+        ...manifestSecretNames(options.manifest),
+        ...settings.map((setting) => setting.name),
+    ];
+    const settingNames = new Set(settings.map((setting) => setting.name));
     for (const secret of secrets) {
+        const field = settingNames.has(secret) ? "settings" : "secrets";
         if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(secret)) {
-            throw new Error(`secrets: "${secret}" isn't a valid binding name.`);
+            throw new Error(`${field}: "${secret}" isn't a valid binding name.`);
         }
         if (env[secret] || RESERVED_SECRET_NAME.test(secret)) {
-            throw new Error(`secrets: ${secret} is a name the deploy sets or a binding it builds.`);
+            throw new Error(`${field}: ${secret} is a name the deploy sets or a binding it builds.`);
         }
     }
     if (!deploy) {
@@ -600,6 +849,12 @@ function addSecrets(env, options, deploy) {
         for (const secret of locallySetSecrets(options.root ?? process.cwd(), options.ctx.mode ?? "development", [...names].filter((name) => !env[name]))) {
             env[secret] = { type: "secret" };
         }
+        // A setting nobody set locally reads its default, as a deployed one does.
+        for (const setting of settings) {
+            if (!env[setting.name] && setting.default !== undefined) {
+                env[setting.name] = { type: "text", value: setting.default };
+            }
+        }
     }
 }
 /** The {@link DEV_GATEWAY_KEYS} of the manifest's providers and capabilities. */
@@ -630,15 +885,6 @@ function observability() {
         issues: { ...EVERYAPP_OBSERVABILITY.issues },
     };
 }
-/**
- * The Workflow a binding defines, named after the app's Worker:
- * `every-acme-seo` and `RANK_CHECK` → `every-acme-seo--rank-check`.
- * Workflow names are unique in the account, and new app ids can't contain
- * `--`, so one app's Workflow is never named like another app's.
- */
-export function workflowNameFor(workerName, binding) {
-    return `${workerName}--${binding.toLowerCase().replaceAll("_", "-")}`;
-}
 /**
  * The local D1 database id for a binding: a 32-hex string, because
  * `cf d1 … --local` rejects names. The everyapp CLI computes the same id to
@@ -709,8 +955,10 @@ function workerNameFor(appId) {
 }
 /**
  * Copies of the gateway's naming rules (@every-app/perimeter/manifest's
- * resourceNameFor and bucketNameFor): `DB` and `KV` (`R2` for a bucket) take
- * the Worker's name, any other binding `<worker>--<binding>`.
+ * resourceNameFor, bucketNameFor, vectorizeNameFor and storeSecretNameFor):
+ * `DB` and `KV` (`R2` for a bucket) take the Worker's name, any other
+ * binding (and every Vectorize index and Secrets Store secret)
+ * `<worker>--<binding>`.
  */
 function resourceNameFor(workerName, binding) {
     return binding === "DB" || binding === "KV"
@@ -720,9 +968,20 @@ function resourceNameFor(workerName, binding) {
 function bucketNameFor(workerName, binding) {
     return binding === "R2" ? workerName : suffixedName(workerName, binding);
 }
+/** A copy of @every-app/perimeter/manifest's queueNameFor: `<worker>--<binding>`. */
+function queueNameFor(workerName, binding) {
+    return suffixedName(workerName, binding);
+}
 function suffixedName(workerName, binding) {
     return `${workerName}--${binding.toLowerCase().replaceAll("_", "-")}`;
 }
+/**
+ * A copy of the gateway's aiGatewayIdFor: one hyphen, since an AI
+ * Gateway's id may not hold `--`.
+ */
+function aiGatewayIdFor(workerName, binding) {
+    return `${workerName}-${binding.toLowerCase().replaceAll("_", "-")}`;
+}
 function assertAppId(id) {
     if (typeof id !== "string" || !/^[a-z]([a-z0-9-]*[a-z0-9])?$/.test(id)) {
         throw new Error(`everyapp.config.ts id must be kebab-case (lowercase letters, digits, hyphens); got ${JSON.stringify(id)}.`);

package/dist/dev/index.d.ts

@@ -3,6 +3,6 @@
  * signs with, its issuer and its key id. For the platform's local dev tools
  * (the CLI, `@every-app/perimeter/dev`); never imported by a Worker.
  */
-export { DEV_ISSUER, DEV_PRIVATE_KEY_PEM, DEV_PUBLIC_KEY_PEM, } from "./keypair.js";
+export { DEV_ISSUER, DEV_ORG_ID, DEV_PRIVATE_KEY_PEM, DEV_PUBLIC_KEY_PEM, } from "./keypair.js";
 export { IDENTITY_DEV_KEY_ID } from "../internal/protocol.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/dev/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/dev/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,UAAU,EACV,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/dev/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,UAAU,EACV,UAAU,EACV,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/dev/index.js

@@ -3,5 +3,5 @@
  * signs with, its issuer and its key id. For the platform's local dev tools
  * (the CLI, `@every-app/perimeter/dev`); never imported by a Worker.
  */
-export { DEV_ISSUER, DEV_PRIVATE_KEY_PEM, DEV_PUBLIC_KEY_PEM, } from "./keypair.js";
+export { DEV_ISSUER, DEV_ORG_ID, DEV_PRIVATE_KEY_PEM, DEV_PUBLIC_KEY_PEM, } from "./keypair.js";
 export { IDENTITY_DEV_KEY_ID } from "../internal/protocol.js";