// Augment the wrangler-generated `Cloudflare.Env` with secrets / vars set at
// deploy time (via `wrangler secret put`, dashboard, or `.dev.vars`) that
// don't show up in `wrangler types` output because they aren't declared in
// wrangler.jsonc, but are what `env.X` resolves to at runtime.
declare global {
  namespace Cloudflare {
    interface Env {
      // Observability
      // Worker version metadata binding (wrangler.jsonc `version_metadata`).
      // Optional so test workers and local setups without the binding still
      // typecheck; spans then carry the "dev" service.version default.
      CF_VERSION_METADATA?: WorkerVersionMetadata;
      // Commit that produced the running deploy, passed by CI as
      // `wrangler deploy --var GIT_COMMIT_SHA:$GITHUB_SHA`. Absent outside CI.
      GIT_COMMIT_SHA?: string;
      AXIOM_TOKEN?: string;
      AXIOM_DATASET?: string;
      AXIOM_TRACES_URL?: string;
      AXIOM_TRACES_SAMPLE_RATIO?: string;
      SENTRY_DSN?: string;
      SENTRY_OTEL_LOG_PAYLOAD?: string;
      SENTRY_OTEL_VERIFY?: string;
      VITE_PUBLIC_SENTRY_DSN?: string;
      VITE_PUBLIC_POSTHOG_KEY?: string;
      VITE_PUBLIC_POSTHOG_HOST?: string;

      // Datastore. Prod uses HYPERDRIVE when the binding exists; direct
      // DATABASE_URL is only selected when explicitly requested for local/test.
      DATABASE_URL?: string;
      EXECUTOR_DIRECT_DATABASE_URL?: string;

      // Static asset binding emitted by @cloudflare/vite-plugin in
      // dist/server/wrangler.json as assets.directory = "../client".
      ASSETS: { readonly fetch: (request: Request) => Promise<Response> };

      // Plugin blob seam backend (wrangler.jsonc `r2_buckets`). Declared here
      // (optional) rather than regenerating worker-configuration.d.ts: test
      // workers and older local setups run without the binding, and the db
      // layer falls back to the Postgres `blob` table when absent. Typed via
      // @cloudflare/workers-types (not the wrangler-generated global) to match
      // what `@executor-js/cloudflare/blob-store` accepts.
      BLOBS?: import("@cloudflare/workers-types").R2Bucket;

      // SSRF / private-network egress guard. Unset in production -> the guard is
      // ON; the test workers set "true" so fixtures can reach localhost.
      ALLOW_LOCAL_NETWORK?: string;

      // Per-org execution rate-limit counter DO (wrangler.jsonc
      // `durable_objects`). Declared optional here (matching the BLOBS
      // precedent) rather than regenerating worker-configuration.d.ts: test
      // workers and older local setups run without the binding, and the
      // limiter degrades to disabled when absent.
      EXECUTION_RATE_LIMITER?: import("@cloudflare/workers-types").DurableObjectNamespace;
      MCP_EXECUTION_OWNER?: import("@cloudflare/workers-types").DurableObjectNamespace;

      // Optional per-org hourly execution rate-limit override, parsed as an
      // integer (defaults to EXECUTIONS_PER_ORG_PER_HOUR = 1000 when unset or
      // unparseable). Exists for e2e: the production cap of 1000/hour can't be
      // exercised with real executions, so the e2e dev-server env sets a small
      // number to drive the backstop. Production leaves it unset.
      EXECUTION_RATE_LIMIT_PER_HOUR?: string;

      // Optional override for the counter DO's check budget in milliseconds
      // (defaults to RATE_LIMIT_CHECK_TIMEOUT_MS = 2000 when unset or
      // unparseable). Same purpose as the cap override: the production budget
      // can't be blown on demand, so tests set a tiny one to exercise the
      // fail-open path. Production leaves it unset.
      EXECUTION_RATE_LIMIT_CHECK_TIMEOUT_MS?: string;

      // First-party OAuth apps (executor-owned provider registrations). Each
      // pair enables one-click connect through `first-party:<provider>`; an
      // unset pair simply ships no first-party app for that provider. The
      // registered callback on the provider side must be
      // `${VITE_PUBLIC_SITE_URL}/api/oauth/callback`.
      FIRST_PARTY_GITHUB_CLIENT_ID?: string;
      FIRST_PARTY_GITHUB_CLIENT_SECRET?: string;
      // Endpoint overrides for the GitHub first-party app, so tests/dev can
      // point it at an emulated provider and complete the whole flow. Unset in
      // production (the real github.com endpoints are the defaults).
      FIRST_PARTY_GITHUB_AUTHORIZE_URL?: string;
      FIRST_PARTY_GITHUB_TOKEN_URL?: string;
      FIRST_PARTY_GOOGLE_CLIENT_ID?: string;
      FIRST_PARTY_GOOGLE_CLIENT_SECRET?: string;
      FIRST_PARTY_SLACK_CLIENT_ID?: string;
      FIRST_PARTY_SLACK_CLIENT_SECRET?: string;

      // Billing
      AUTUMN_SECRET_KEY?: string;
      /** Optional Autumn base-URL override (Autumn emulator in tests/dev). */
      AUTUMN_API_URL?: string;

      /** Optional WorkOS base-URL override (WorkOS emulator in tests/dev). */
      WORKOS_API_URL?: string;

      // MCP
      EXECUTOR_MCP_DEBUG?: string;
      MCP_AUTHKIT_DOMAIN?: string;
      MCP_RESOURCE_ORIGIN?: string;
      MCP_SESSION_TIMEOUT_MS?: string;
      MCP_PAUSED_SESSION_IDLE_TIMEOUT_MS?: string;
      NODE_ENV?: string;

      // Shared with frontend
      VITE_PUBLIC_SITE_URL?: string;
      VITE_PUBLIC_OTLP_TRACES_URL?: string;
      VITE_PUBLIC_OTLP_SAMPLE_RATIO?: string;
    }
  }
}

export {};