{
  "$schema": "node_modules/wrangler/config-schema.json",
  "name": "executor-cloudflare",
  "compatibility_date": "2025-04-01",
  "compatibility_flags": ["nodejs_compat"],
  "main": "src/worker.ts",
  "observability": { "enabled": true },
  // The web UI (Workers Static Assets) — the shared multiplayer SPA built by
  // `vite build` into ./dist. `single-page-application` serves index.html for
  // client routes (e.g. /policies); `run_worker_first` forces the API + MCP
  // paths to the Worker instead of the SPA fallback.
  "assets": {
    "directory": "./dist",
    "not_found_handling": "single-page-application",
    "run_worker_first": ["/api/*", "/mcp", "/mcp/*"],
  },
  // D1 is the app's SQLite store (the DbProvider seam). `wrangler deploy`
  // auto-provisions it on first deploy; replace database_id after that, or run
  // `wrangler d1 create executor` and paste the id here.
  "d1_databases": [
    {
      "binding": "DB",
      "database_name": "executor",
      "database_id": "ae748ca1-032c-4427-a1a0-fe39db77d1a9",
    },
  ],
  // Plugin blob seam backend: multi-MB values (resolved OpenAPI specs,
  // introspection snapshots) live here, not in D1 (which caps a value at
  // ~1-2MB). `wrangler r2 bucket create executor-blobs` provisions it.
  "r2_buckets": [
    {
      "binding": "BLOBS",
      "bucket_name": "executor-blobs",
    },
  ],
  // The MCP session Durable Object: one addressable isolate per MCP session (the
  // DO id IS the session id) so a session survives across the Worker's stateless
  // isolates — without it, `tools/list` after `initialize` can land on a fresh
  // isolate that never saw the session ("Not connected"). `new_sqlite_classes`
  // is the free-tier-eligible SQLite-backed DO storage.
  "durable_objects": {
    "bindings": [{ "name": "MCP_SESSION", "class_name": "McpSessionDO" }],
  },
  "migrations": [{ "tag": "v1", "new_sqlite_classes": ["McpSessionDO"] }],
  // Cloudflare Access is the entire auth layer: the Worker validates the
  // Cf-Access-Jwt-Assertion JWT against the team JWKS. Set these to your Zero
  // Trust team domain + the Access application's AUD tag. EXECUTOR_SECRET_KEY
  // (the at-rest secret-encryption key) is a SECRET — set it with
  // `wrangler secret put EXECUTOR_SECRET_KEY`, never in vars.
  "vars": {
    "ACCESS_TEAM_DOMAIN": "your-team.cloudflareaccess.com",
    "ACCESS_AUD": "",
    "ACCESS_NAME_CLAIM": "name",
    "ACCESS_GROUPS_CLAIM": "groups",
    "ADMIN_EMAILS": "",
    "SELF_HOSTED_ORG_ID": "default",
    "SELF_HOSTED_ORG_NAME": "Default",
    // VITE_PUBLIC_SITE_URL is intentionally unset: with no static URL the worker
    // derives the web base URL from each request's origin (RequestWebOrigin), so
    // secret/OAuth handoff links match whatever host the user actually reached.
    // Set it only to force a canonical URL (e.g. behind a proxy that rewrites Host).
  },
}