Host process
VENDO_TICK_SECRET, VENDO_BASE_URL, VENDO_PROXY_URL, and
VENDO_POSTHOG_KEY are implementation-level environment configuration. The
frozen contracts define the corresponding bearer, route origin, proxy, and
telemetry seams without requiring those names from custom compositions.
App machine environment
The apps runtime injects these values:
When
VENDO_PROXY_URL and VENDO_RUN_TOKEN are both present, the runtime’s
in-machine fetch shim routes outbound fetch() calls to external hosts through
the proxy’s egress route, where secret handles are substituted for allowlisted
hosts only. See Secrets and outbound requests.
The proxy authenticates every request with VENDO_RUN_TOKEN and enforces the
app’s declarations. It exposes:
Collections not present in the app’s
storage declaration return 403.
Records reject unknown or empty refs keys with 400.
Peer configuration
Vendo receives an AI SDKLanguageModel; model provider keys are configured by
that provider, not selected by a Vendo environment-variable ladder. Connector
keys are passed to connector constructors. Modal credentials are passed to
modalSandbox({ tokenId, tokenSecret }). The hosted vendoSandbox() adapter
reads VENDO_API_KEY and VENDO_CLOUD_URL from the process; see
Vendo Cloud for the full setup.
The store receives its Postgres URL through createStore({ url }) and its
PGlite directory through createStore({ dataDir }). Those option names are the
contract; V0 does not define storage environment-variable aliases.