@every-app/sdk 0.3.0-rc.2 → 0.3.0-rc.4

package/README.md

@@ -1,6 +1,6 @@
 # @every-app/sdk
 
-The embedded SDK for building apps on the Every App platform.
+The embedded SDK for building apps on the EveryApp platform.
 
 It verifies the identity the Gateway injects, defines the app's Worker and its agent tools, and reaches the Gateway's AI, email and integrations. There is no client-side export.
 

package/dist/cloudflare/index.d.ts

@@ -17,6 +17,6 @@
  * `/internal` would break `cf dev` wherever the SDK is linked from source.
  * (The dev keypair it hands the dev Worker is a leaf the Worker never loads.)
  */
-export { EVERYAPP_OBSERVABILITY, everyAppAuxiliaryWorker, everyAppWorker, helperWorkerName, localD1Id, localD1Path, workflowNameFor, type AiBinding, type D1Binding, type DurableObjectBinding, type DurableObjectExport, type EveryAppAuxiliaryWorkerConfig, type EveryAppAuxiliaryWorkerOptions, type EveryAppBinding, type EveryAppConfigContext, type EveryAppDeployEnv, type EveryAppDevEnv, type EveryAppExports, type EveryAppObservability, type EveryAppPlacement, type EveryAppWorkerConfig, type EveryAppWorkerManifest, type EveryAppWorkerOptions, type EveryAppWorkerReference, type GatewayBinding, type HyperdriveBinding, type KvBinding, type SecretBinding, type ServiceBinding, type TextBinding, type VersionMetadataBinding, type WorkflowBinding, type WorkflowExport, } from "./worker.js";
-export { BUILD_SENTINEL, resourceSentinel, sentinelDeployTarget, type EveryAppDeployTarget, } from "./sentinel.js";
+export { EVERYAPP_OBSERVABILITY, everyAppAuxiliaryWorker, everyAppWorker, helperWorkerName, localD1Id, localD1Path, workflowNameFor, type AiBinding, type AnalyticsEngineDatasetBinding, type BrowserBinding, type AiGatewayBinding, type D1Binding, type DurableObjectBinding, type DurableObjectExport, type EveryAppAuxiliaryWorkerConfig, type EveryAppAuxiliaryWorkerOptions, type EveryAppBinding, type EveryAppConfigContext, type EveryAppDeployEnv, type EveryAppDevEnv, type EveryAppExports, type EveryAppObservability, type EveryAppPlacement, type EveryAppTrigger, type EveryAppWorkerConfig, type EveryAppWorkerManifest, type EveryAppWorkerOptions, type EveryAppWorkerReference, type GatewayBinding, type HyperdriveBinding, type ImagesBinding, type JsonBinding, type KvBinding, type QueueBinding, type QueueConsumerTrigger, type SecretBinding, type SecretsStoreSecretBinding, type SendEmailBinding, type ServiceBinding, type TextBinding, type VectorizeBinding, type VersionMetadataBinding, type WorkflowBinding, type WorkflowExport, } from "./worker.js";
+export { aiGatewayUrl, BUILD_SENTINEL, resourceSentinel, sentinelDeployTarget, type AiGatewayValue, type EveryAppDeployTarget, } from "./sentinel.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/cloudflare/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cloudflare/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,cAAc,EACd,gBAAgB,EAChB,SAAS,EACT,WAAW,EACX,eAAe,EACf,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,6BAA6B,EAClC,KAAK,8BAA8B,EACnC,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC5B,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACpB,KAAK,cAAc,GACpB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,KAAK,oBAAoB,GAC1B,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cloudflare/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,cAAc,EACd,gBAAgB,EAChB,SAAS,EACT,WAAW,EACX,eAAe,EACf,KAAK,SAAS,EACd,KAAK,6BAA6B,EAClC,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,SAAS,EACd,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,6BAA6B,EAClC,KAAK,8BAA8B,EACnC,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC5B,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,YAAY,EACjB,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,yBAAyB,EAC9B,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACpB,KAAK,cAAc,GACpB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,YAAY,EACZ,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,KAAK,cAAc,EACnB,KAAK,oBAAoB,GAC1B,MAAM,eAAe,CAAC"}

package/dist/cloudflare/index.js

@@ -18,4 +18,4 @@
  * (The dev keypair it hands the dev Worker is a leaf the Worker never loads.)
  */
 export { EVERYAPP_OBSERVABILITY, everyAppAuxiliaryWorker, everyAppWorker, helperWorkerName, localD1Id, localD1Path, workflowNameFor, } from "./worker.js";
-export { BUILD_SENTINEL, resourceSentinel, sentinelDeployTarget, } from "./sentinel.js";
+export { aiGatewayUrl, BUILD_SENTINEL, resourceSentinel, sentinelDeployTarget, } from "./sentinel.js";

package/dist/cloudflare/sentinel.d.ts

@@ -14,14 +14,22 @@
 export declare const BUILD_SENTINEL: Readonly<{
     workerName: "every-hosted--sentinel";
     organizationId: "everyapp-hosted-deploy-sentinel";
+    /**
+     * The Cloudflare account the app is installed in (an AI Gateway's URL
+     * holds it). Starts with the Worker name's placeholder, so an install
+     * rewrites it before that one.
+     */
+    accountId: "every-hosted--sentinel-account";
     /** The gateway's URL, and so the identity issuer. */
     gatewayUrl: "https://every-hosted--sentinel.invalid";
     publicKey: "-----BEGIN PUBLIC KEY-----\nEVERYAPPHOSTEDDEPLOYSENTINEL\n-----END PUBLIC KEY-----\n";
 }>;
 /**
  * A manifest binding's placeholder: a D1 database's name and id, an R2
- * bucket's name, a KV namespace's or Hyperdrive config's id. The installer
- * rewrites each by its binding name; the value only has to be recognizable.
+ * bucket's, queue's or Vectorize index's name, a KV namespace's, Hyperdrive
+ * config's or AI Gateway's id, a Secrets Store secret's store id and name.
+ * The installer rewrites each by its binding name; the value only has to
+ * be recognizable.
  */
 export declare function resourceSentinel(binding: string): string;
 /** The fields of the manifest a build's placeholders are made for. */
@@ -33,14 +41,42 @@ interface SentinelManifest {
         hyperdrive?: readonly {
             readonly name: string;
         }[];
+        queues?: readonly {
+            readonly name: string;
+        }[];
+        vectorize?: readonly {
+            readonly name: string;
+        }[];
+        aiGateway?: readonly {
+            readonly name: string;
+        }[];
+        secretsStore?: readonly {
+            readonly name: string;
+        }[];
     };
 }
+/** Where an AI Gateway takes requests: `https://gateway.ai.cloudflare.com/v1/<account>/<id>`. */
+export declare function aiGatewayUrl(accountId: string, id: string): string;
+/**
+ * What an AI Gateway binding holds (a `json` binding): the gateway's id,
+ * its account, and its URL, under which each provider has a path
+ * (`<url>/openai`, `<url>/anthropic`, `<url>/workers-ai`, `<url>/compat`).
+ * In development `accountId` and `url` are empty: there is no gateway, so
+ * an app calls the provider directly.
+ */
+export type AiGatewayValue = {
+    id: string;
+    accountId: string;
+    url: string;
+};
 /** Everything install-specific a Worker is built from, by binding. */
 export interface EveryAppDeployTarget {
     /** The Worker name the gateway registry assigned to this app. */
     workerName: string;
     /** The organization that owns the app; scopes the AppGateway binding. */
     organizationId: string;
+    /** The Cloudflare account the app is installed in. */
+    accountId: string;
     /** The gateway's URL, which is also the identity tokens' issuer. */
     gatewayUrl: string;
     /** SPKI PEM public keys (current + next) that verify identity tokens. */
@@ -61,6 +97,25 @@ export interface EveryAppDeployTarget {
         r2?: Record<string, {
             name: string;
         }>;
+        /** Queues by binding: each one's name (which its bindings and triggers use) and id. */
+        queues?: Record<string, {
+            name: string;
+            id: string;
+        }>;
+        /** Vectorize indexes by binding, under the names the deploy provisioned. */
+        vectorize?: Record<string, {
+            name: string;
+        }>;
+        /** AI Gateways by binding: each binding's whole value. */
+        aiGateway?: Record<string, AiGatewayValue>;
+        /**
+         * Secrets Store secrets by binding: the account's store and the
+         * secret the deploy made in it.
+         */
+        secretsStore?: Record<string, {
+            storeId: string;
+            secretName: string;
+        }>;
     };
 }
 /** The target every production build is made for: placeholders throughout. */

package/dist/cloudflare/sentinel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sentinel.d.ts","sourceRoot":"","sources":["../../src/cloudflare/sentinel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,eAAO,MAAM,cAAc;;;IAKzB,qDAAqD;;;EAIrD,CAAC;AAEH;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,sEAAsE;AACtE,UAAU,gBAAgB;IACxB,SAAS,CAAC,EAAE;QACV,EAAE,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACvB,EAAE,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACvB,EAAE,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACvB,UAAU,CAAC,EAAE,SAAS;YAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KACnD,CAAC;CACH;AAED,sEAAsE;AACtE,MAAM,WAAW,oBAAoB;IACnC,iEAAiE;IACjE,UAAU,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,cAAc,EAAE,MAAM,CAAC;IACvB,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,4DAA4D;IAC5D,SAAS,EAAE;QACT,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAClD,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACpC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAC5C,oEAAoE;QACpE,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KACvC,CAAC;CACH;AAED,8EAA8E;AAC9E,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,gBAAgB,GACzB,oBAAoB,CA2BtB"}
+{"version":3,"file":"sentinel.d.ts","sourceRoot":"","sources":["../../src/cloudflare/sentinel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,eAAO,MAAM,cAAc;;;IAKzB;;;;OAIG;;IAEH,qDAAqD;;;EAIrD,CAAC;AAEH;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,sEAAsE;AACtE,UAAU,gBAAgB;IACxB,SAAS,CAAC,EAAE;QACV,EAAE,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACvB,EAAE,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACvB,EAAE,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACvB,UAAU,CAAC,EAAE,SAAS;YAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAClD,MAAM,CAAC,EAAE,SAAS;YAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAC9C,SAAS,CAAC,EAAE,SAAS;YAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QACjD,SAAS,CAAC,EAAE,SAAS;YAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QACjD,YAAY,CAAC,EAAE,SAAS;YAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;KACrD,CAAC;CACH;AAED,iGAAiG;AACjG,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAElE;AAED;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5E,sEAAsE;AACtE,MAAM,WAAW,oBAAoB;IACnC,iEAAiE;IACjE,UAAU,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,cAAc,EAAE,MAAM,CAAC;IACvB,sDAAsD;IACtD,SAAS,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,4DAA4D;IAC5D,SAAS,EAAE;QACT,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAClD,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACpC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAC5C,oEAAoE;QACpE,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACtC,uFAAuF;QACvF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACtD,4EAA4E;QAC5E,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAC7C,0DAA0D;QAC1D,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;QAC3C;;;WAGG;QACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KACxE,CAAC;CACH;AAED,8EAA8E;AAC9E,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,gBAAgB,GACzB,oBAAoB,CAoDtB"}

package/dist/cloudflare/sentinel.js

@@ -16,18 +16,30 @@ export const BUILD_SENTINEL = Object.freeze({
     // and a string rewrite of it can't hit anything else.
     workerName: "every-hosted--sentinel",
     organizationId: "everyapp-hosted-deploy-sentinel",
+    /**
+     * The Cloudflare account the app is installed in (an AI Gateway's URL
+     * holds it). Starts with the Worker name's placeholder, so an install
+     * rewrites it before that one.
+     */
+    accountId: "every-hosted--sentinel-account",
     /** The gateway's URL, and so the identity issuer. */
     gatewayUrl: "https://every-hosted--sentinel.invalid",
     publicKey: "-----BEGIN PUBLIC KEY-----\nEVERYAPPHOSTEDDEPLOYSENTINEL\n-----END PUBLIC KEY-----\n",
 });
 /**
  * A manifest binding's placeholder: a D1 database's name and id, an R2
- * bucket's name, a KV namespace's or Hyperdrive config's id. The installer
- * rewrites each by its binding name; the value only has to be recognizable.
+ * bucket's, queue's or Vectorize index's name, a KV namespace's, Hyperdrive
+ * config's or AI Gateway's id, a Secrets Store secret's store id and name.
+ * The installer rewrites each by its binding name; the value only has to
+ * be recognizable.
  */
 export function resourceSentinel(binding) {
     return `${BUILD_SENTINEL.workerName}--${binding}`;
 }
+/** Where an AI Gateway takes requests: `https://gateway.ai.cloudflare.com/v1/<account>/<id>`. */
+export function aiGatewayUrl(accountId, id) {
+    return `https://gateway.ai.cloudflare.com/v1/${accountId}/${id}`;
+}
 /** The target every production build is made for: placeholders throughout. */
 export function sentinelDeployTarget(manifest) {
     const byBinding = (bindings, value) => Object.fromEntries((bindings ?? []).map((binding) => [
@@ -38,6 +50,7 @@ export function sentinelDeployTarget(manifest) {
     return {
         workerName: BUILD_SENTINEL.workerName,
         organizationId: BUILD_SENTINEL.organizationId,
+        accountId: BUILD_SENTINEL.accountId,
         gatewayUrl: BUILD_SENTINEL.gatewayUrl,
         identityPublicKeys: [BUILD_SENTINEL.publicKey],
         resources: {
@@ -45,6 +58,18 @@ export function sentinelDeployTarget(manifest) {
             kv: byBinding(resources?.kv, (id) => ({ id })),
             hyperdrive: byBinding(resources?.hyperdrive?.map((config) => config.name), (id) => ({ id })),
             r2: byBinding(resources?.r2, (name) => ({ name })),
+            ...(resources?.queues?.length
+                ? {
+                    queues: byBinding(resources.queues.map((queue) => queue.name), (name) => ({ name, id: name })),
+                }
+                : {}),
+            vectorize: byBinding(resources?.vectorize?.map((index) => index.name), (name) => ({ name })),
+            aiGateway: byBinding(resources?.aiGateway?.map((gateway) => gateway.name), (id) => ({
+                id,
+                accountId: BUILD_SENTINEL.accountId,
+                url: aiGatewayUrl(BUILD_SENTINEL.accountId, id),
+            })),
+            secretsStore: byBinding(resources?.secretsStore?.map((secret) => secret.name), (placeholder) => ({ storeId: placeholder, secretName: placeholder })),
         },
     };
 }

package/dist/cloudflare/worker.d.ts

@@ -1,3 +1,4 @@
+import { type AiGatewayValue } from "./sentinel.js";
 /** A Durable Object or Workflow class, and the helper Worker defining it. */
 interface ClassResource {
     readonly name: string;
@@ -13,6 +14,62 @@ interface HyperdriveResource {
     /** Whether Hyperdrive caches its reads (the deploy's concern; "off" by default). */
     readonly caching?: "off" | "default";
 }
+/**
+ * How a queue's consumer takes its messages (`@cloudflare/config`'s
+ * `QueueConsumerTriggerOptions` but the name), and the helper Worker that
+ * consumes, when not the app's own.
+ */
+interface QueueConsumerSettings {
+    /** A helper Worker (`workers`) that consumes; the app's own when unset. */
+    readonly worker?: string;
+    readonly maxBatchSize?: number;
+    readonly maxBatchTimeout?: number;
+    readonly maxRetries?: number;
+    readonly maxConcurrency?: number | null;
+    readonly retryDelay?: number;
+    readonly visibilityTimeoutMs?: number;
+    /** Another of the manifest's queue bindings, which takes the messages that ran out of retries. */
+    readonly deadLetterQueue?: string;
+}
+/** A queue every Worker of the app produces to, and the Worker that consumes it. */
+interface QueueResource {
+    readonly name: string;
+    /** `true`: the app's own Worker consumes; settings, maybe naming a helper Worker. */
+    readonly consumer?: true | QueueConsumerSettings;
+}
+/**
+ * A Vectorize index: `dimensions` and `metric`, or a `preset` (the
+ * deploy's concern; the Worker only binds it by name).
+ */
+interface VectorizeResource {
+    readonly name: string;
+    readonly dimensions?: number;
+    readonly metric?: string;
+    readonly preset?: string;
+}
+/** An AI Gateway of the app's own, which every one of its Workers binds. */
+interface AiGatewayResource {
+    readonly name: string;
+    /** Whether the gateway logs each request (the deploy's concern; on by default). */
+    readonly collectLogs?: boolean;
+    /** How long the gateway caches a response, in seconds (the deploy's concern; 0 by default). */
+    readonly cacheTtl?: number;
+}
+/**
+ * A Cloudflare `send_email` binding and the addresses it may use: the
+ * senders, and one destination or a list of them (never both).
+ */
+interface SendEmailResource {
+    readonly name: string;
+    readonly allowedSenderAddresses?: readonly string[];
+    readonly destinationAddress?: string;
+    readonly allowedDestinationAddresses?: readonly string[];
+}
+/** An Analytics Engine dataset, by binding, and its name when not the default. */
+interface AnalyticsEngineResource {
+    readonly name: string;
+    readonly dataset?: string;
+}
 /** Cloudflare's limits for one of the app's Workers. */
 interface WorkerLimits {
     readonly cpuMs?: number;
@@ -33,6 +90,12 @@ export interface EveryAppWorkerManifest {
         workflows?: readonly ClassResource[];
         /** Hyperdrive configs, named `<app worker>--<binding>` by the deploy. */
         hyperdrive?: readonly HyperdriveResource[];
+        /**
+         * Cloudflare Queues, named `<app worker>--<binding>`: every Worker of
+         * the app binds each one to produce, and the consumer's Worker gets
+         * its trigger.
+         */
+        queues?: readonly QueueResource[];
         /**
          * Workers AI, by binding (`["AI"]`), which every one of the app's
          * Workers binds: nothing to create, billed to the account. In
@@ -40,6 +103,50 @@ export interface EveryAppWorkerManifest {
          * turns `remoteBindings` on (see {@link AiBinding}).
          */
         ai?: readonly string[];
+        /**
+         * Browser Rendering, by binding (`["BROWSER"]`), which every one of the
+         * app's Workers binds: nothing to create (Workers Paid). Local in
+         * development (see {@link BrowserBinding}).
+         */
+        browser?: readonly string[];
+        /**
+         * Cloudflare Images, by binding (`["IMAGES"]`), which every one of the
+         * app's Workers binds: nothing to create. Local in development (see
+         * {@link ImagesBinding}).
+         */
+        images?: readonly string[];
+        /**
+         * Vectorize indexes every one of the app's Workers binds, named
+         * `<app worker>--<binding>`. Cloudflare has no local Vectorize: in
+         * development each binding reaches the account's index (`dev.remote`),
+         * once the Vite plugin's `remoteBindings` is on and `cf auth login` ran.
+         */
+        vectorize?: readonly VectorizeResource[];
+        /**
+         * AI Gateways of the app's own, each `<app worker>-<binding>` in the
+         * account, bound on every Worker as `{ id, accountId, url }`.
+         */
+        aiGateway?: readonly AiGatewayResource[];
+        /**
+         * Cloudflare `send_email` bindings every one of the app's Workers
+         * gets, with their addresses; nothing is made in the account.
+         */
+        sendEmail?: readonly SendEmailResource[];
+        /**
+         * Secrets Store secrets, by binding (`[{ name: "STRIPE_KEY" }]`), which
+         * every one of the app's Workers binds: each a secret in the account's
+         * store named `<app worker>--<binding>`, made by the deploy (see
+         * {@link SecretsStoreSecretBinding}).
+         */
+        secretsStore?: readonly {
+            readonly name: string;
+        }[];
+        /**
+         * Analytics Engine datasets every one of the app's Workers writes to, by
+         * binding: `dataset` as written, else `<app worker>--<binding>`.
+         * Nothing to create; `writeDataPoint()` does nothing in development.
+         */
+        analyticsEngine?: readonly AnalyticsEngineResource[];
     };
     /**
      * Helper Workers deployed beside the app's Worker as
@@ -148,6 +255,21 @@ export interface HyperdriveBinding {
         connectionString?: string;
     };
 }
+/** A producer binding to one of the app's queues. */
+export interface QueueBinding {
+    type: "queue";
+    name: string;
+}
+/** A JSON value the Worker reads as it is: `env.<NAME>` is `value`. */
+export interface JsonBinding<T = unknown> {
+    type: "json";
+    value: T;
+}
+/**
+ * An AI Gateway of the app's own (`resources.aiGateway`): its id, account
+ * and URL, which the Worker reads as `env.<NAME>.id` and `env.<NAME>.url`.
+ */
+export type AiGatewayBinding = JsonBinding<AiGatewayValue>;
 /**
  * Workers AI (`env.AI.run()`), which cf types as `Ai`. Deployed, it calls
  * the account's Workers AI. Miniflare has none locally: in development the
@@ -162,6 +284,78 @@ export interface AiBinding {
         remote?: boolean;
     };
 }
+/**
+ * Browser Rendering (`env.BROWSER`, for `@cloudflare/puppeteer` or
+ * `@cloudflare/playwright`), which cf types as `BrowserRun`. Deployed, it
+ * drives a headless Chrome on Cloudflare (Workers Paid). In development
+ * the same binding reaches Miniflare's local stand-in: the first session
+ * downloads a Chrome into the global `.wrangler` cache and starts it.
+ */
+export interface BrowserBinding {
+    type: "browser";
+}
+/**
+ * Cloudflare Images (`env.IMAGES.input(stream).transform(…).output(…)`,
+ * `env.IMAGES.info(stream)`), which cf types as the runtime's
+ * `ImagesBinding`. Deployed, it runs on Cloudflare and bills the account's
+ * Images transformations. In development Miniflare answers it locally with
+ * sharp, which ships with it.
+ */
+export interface ImagesBinding {
+    type: "images";
+}
+/**
+ * A Vectorize index, by name. `dev.remote` sends development calls to the
+ * account's index: Cloudflare has no local Vectorize.
+ */
+export interface VectorizeBinding {
+    type: "vectorize";
+    name: string;
+    dev?: {
+        remote?: boolean;
+    };
+}
+/**
+ * A `send_email` binding (cf's `SendEmailBindingOptions`): one destination,
+ * a list of them, or neither, and the senders it may use.
+ */
+type SendEmailDestination = {
+    destinationAddress: string;
+    allowedDestinationAddresses?: never;
+} | {
+    destinationAddress?: never;
+    allowedDestinationAddresses: string[];
+} | {
+    destinationAddress?: never;
+    allowedDestinationAddresses?: never;
+};
+export type SendEmailBinding = SendEmailDestination & {
+    type: "send-email";
+    allowedSenderAddresses?: string[];
+};
+/**
+ * A Secrets Store secret (`await env.STRIPE_KEY.get()`), which cf types as
+ * `SecretsStoreSecret`. Deployed, the secret the deploy made in the
+ * account's store; in development, the local store `local` that Miniflare
+ * keeps under `.cloudflare/state`, where `get()` throws `Secret "<name>"
+ * not found` until the secret is seeded there (`.dev.vars` doesn't reach
+ * this binding).
+ */
+export interface SecretsStoreSecretBinding {
+    type: "secrets-store-secret";
+    storeId: string;
+    secretName: string;
+}
+/**
+ * An Analytics Engine dataset (`env.EVENTS.writeDataPoint({ blobs,
+ * doubles, indexes })`), which cf types as `AnalyticsEngineDataset`.
+ * Deployed, the dataset exists once written to. In development Miniflare
+ * accepts every write and keeps none. cf's shape takes no `dev` options.
+ */
+export interface AnalyticsEngineDatasetBinding {
+    type: "analytics-engine-dataset";
+    name: string;
+}
 /**
  * The app's own Worker, as the bindings of the Durable Objects it defines
  * name it when its entrypoint is a `cf-worker` module import. cf reads each
@@ -205,7 +399,15 @@ export interface ServiceBinding {
 export interface VersionMetadataBinding {
     type: "version-metadata";
 }
-export type EveryAppBinding = TextBinding | SecretBinding | D1Binding | KvBinding | R2Binding | HyperdriveBinding | AiBinding | DurableObjectBinding<string | EveryAppWorkerReference<object>> | WorkflowBinding | GatewayBinding | ServiceBinding | VersionMetadataBinding;
+/**
+ * A binding of any Worker these helpers build, each one `InputWorkerConfig`
+ * accepts, so a helper Worker's definition passes as the Vite plugin's
+ * `auxiliaryWorkers` config. A Durable Object binding names its Worker by
+ * name; only the app's own Worker names itself by definition (see
+ * {@link EveryAppWorkerReference}), in its typed `env`, which
+ * `defineConfig()` takes.
+ */
+export type EveryAppBinding = TextBinding | SecretBinding | D1Binding | KvBinding | R2Binding | HyperdriveBinding | QueueBinding | AiBinding | BrowserBinding | ImagesBinding | VectorizeBinding | AiGatewayBinding | SendEmailBinding | SecretsStoreSecretBinding | AnalyticsEngineDatasetBinding | DurableObjectBinding | WorkflowBinding | GatewayBinding | ServiceBinding | VersionMetadataBinding;
 export interface DurableObjectExport {
     type: "durable-object";
     storage: "sqlite";
@@ -234,6 +436,37 @@ type AiNames<M> = M extends {
         ai: readonly (infer B)[];
     };
 } ? B & string : never;
+type BrowserNames<M> = M extends {
+    resources: {
+        browser: readonly (infer B)[];
+    };
+} ? B & string : never;
+type ImagesNames<M> = M extends {
+    resources: {
+        images: readonly (infer B)[];
+    };
+} ? B & string : never;
+type VectorizeNames<M> = M extends {
+    resources: {
+        vectorize: readonly (infer V)[];
+    };
+} ? V extends {
+    name: infer N extends string;
+} ? N : never : never;
+type AiGatewayNames<M> = M extends {
+    resources: {
+        aiGateway: readonly (infer G)[];
+    };
+} ? G extends {
+    name: infer N extends string;
+} ? N : never : never;
+type AnalyticsEngineNames<M> = M extends {
+    resources: {
+        analyticsEngine: readonly (infer A)[];
+    };
+} ? A extends {
+    name: infer N extends string;
+} ? N : never : never;
 type DurableObjects<M> = M extends {
     resources: {
         durableObjects: readonly (infer D)[];
@@ -244,6 +477,27 @@ type Workflows<M> = M extends {
         workflows: readonly (infer W)[];
     };
 } ? W : never;
+type QueueNames<M> = M extends {
+    resources: {
+        queues: readonly (infer Q)[];
+    };
+} ? Q extends {
+    name: infer N extends string;
+} ? N : never : never;
+type SendEmailNames<M> = M extends {
+    resources: {
+        sendEmail: readonly (infer S)[];
+    };
+} ? S extends {
+    name: infer N extends string;
+} ? N : never : never;
+type SecretsStoreNames<M> = M extends {
+    resources: {
+        secretsStore: readonly (infer S)[];
+    };
+} ? S extends {
+    name: infer N extends string;
+} ? N : never : never;
 type HelperWorkers<M> = M extends {
     workers: readonly (infer H)[];
 } ? H : never;
@@ -380,8 +634,24 @@ type ResourceEnv<M, TEntrypoint> = {
     [B in KvNames<M>]: KvBinding;
 } & {
     [B in R2Names<M>]: R2Binding;
+} & {
+    [B in QueueNames<M>]: QueueBinding;
 } & {
     [B in AiNames<M>]: AiBinding;
+} & {
+    [B in BrowserNames<M>]: BrowserBinding;
+} & {
+    [B in ImagesNames<M>]: ImagesBinding;
+} & {
+    [B in VectorizeNames<M>]: VectorizeBinding;
+} & {
+    [B in AiGatewayNames<M>]: AiGatewayBinding;
+} & {
+    [B in SendEmailNames<M>]: SendEmailBinding;
+} & {
+    [B in SecretsStoreNames<M>]: SecretsStoreSecretBinding;
+} & {
+    [B in AnalyticsEngineNames<M>]: AnalyticsEngineDatasetBinding;
 } & {
     [D in DurableObjects<M> as D extends {
         name: infer N extends string;
@@ -425,6 +695,8 @@ export type EveryAppDevEnv<M, TEntrypoint = string> = ResourceEnv<M, TEntrypoint
     EVERYAPP_DEV_PROVIDERS?: TextBinding;
     EVERYAPP_IDENTITY_PUBLIC_KEYS: TextBinding;
     EVERYAPP_IDENTITY_ISSUER: TextBinding;
+    /** The stub dev gateway's organization (`dev-org`), so `withOrganization(env.EVERY_APP_ORG_ID, …)` works in development as deployed. */
+    EVERY_APP_ORG_ID: TextBinding;
 } & {
     [K in DevGatewayKeys<M>]: SecretBinding;
 };
@@ -482,6 +754,23 @@ export interface ScheduledTrigger {
     type: "scheduled";
     schedule: string;
 }
+/**
+ * Structural copy of cf's queue consumer trigger: the Worker consumes the
+ * named queue (its `queue(batch, env)` handler), with these settings.
+ */
+export interface QueueConsumerTrigger {
+    type: "queue";
+    name: string;
+    deadLetterQueue?: string;
+    maxBatchSize?: number;
+    maxBatchTimeout?: number;
+    maxConcurrency?: number | null;
+    maxRetries?: number;
+    retryDelay?: number;
+    visibilityTimeoutMs?: number;
+}
+/** A trigger one of the app's Workers may have: its crons, the queues it consumes. */
+export type EveryAppTrigger = ScheduledTrigger | QueueConsumerTrigger;
 export interface EveryAppWorkerConfig<M, TEntrypoint> {
     name: string;
     entrypoint: TEntrypoint;
@@ -489,8 +778,8 @@ export interface EveryAppWorkerConfig<M, TEntrypoint> {
     compatibilityFlags: string[];
     workersDev: false;
     previewUrls: false;
-    /** The `crons` option's schedules; absent without any. */
-    triggers?: ScheduledTrigger[];
+    /** The `crons` option's schedules and the queues it consumes; absent without any. */
+    triggers?: EveryAppTrigger[];
     /** Near the manifest's `database.region`, once deployed. */
     placement?: EveryAppPlacement;
     /** The manifest's `limits`. */
@@ -537,7 +826,7 @@ export interface EveryAppAuxiliaryWorkerConfig<TEntrypoint> {
     compatibilityFlags: string[];
     workersDev: false;
     previewUrls: false;
-    triggers?: ScheduledTrigger[];
+    triggers?: EveryAppTrigger[];
     placement?: EveryAppPlacement;
     limits?: {
         cpuMs?: number;
@@ -550,7 +839,10 @@ export interface EveryAppAuxiliaryWorkerConfig<TEntrypoint> {
  * Build the definition of one of the app's helper Workers (the manifest's
  * `workers`), e.g. one that runs a memory-hungry job away from the app's
  * Worker. It is named `<app worker>--<worker>`, is private like the app, and
- * binds the app's D1 databases, KV namespaces, R2 buckets and Workers AI, the classes it defines, and
+ * binds the app's  and Analytics Engine datasets, the classes it defines, and
+ * binds the app's D1 databases, KV namespaces, R2 buckets, Workers AI,
+ * Browser Rendering, Images, Vectorize indexes, AI Gateways, `send_email`
+ * bindings and Secrets Store secrets, the classes it defines, and
  * the gateway (with the app's identity, for capabilities). Only the app's
  * Worker reaches it. Pass it to the Vite plugin:
  *