name = "any-managed-agents"
main = "./server/worker.ts"
compatibility_date = "2026-05-07"
compatibility_flags = ["nodejs_compat"]
workers_dev = true
preview_urls = true
routes = [
  { pattern = "enbor.realmroot.dev", custom_domain = true },
]

[assets]
binding = "ASSETS"
directory = "./dist/client"
not_found_handling = "single-page-application"
run_worker_first = ["/api", "/api/*", "/runtime/*", "/.well-known/oauth-protected-resource/api"]

[vars]
ALLOWED_ORIGINS = "https://enbor.realmroot.dev,https://enbor.saltbo.workers.dev"
RUNTIME_MODE = "live"
SANDBOX_TRANSPORT = "rpc"
AI_GATEWAY_ID = "enbor"
OIDC_ISSUER = "https://id.realmroot.dev/api/auth"
OIDC_RESOURCE = "https://enbor.realmroot.dev/api"
OIDC_BROWSER_SCOPES = "openid profile email agents:read agents:write audit-records:read audit-records:write auth:read auth:write budgets:read budgets:write connectors:read connectors:write environments:read environments:write identities:read identities:write leases:read leases:write memory-stores:read memory-stores:write projects:read projects:write providers:read providers:write runners:read runners:write sessions:read sessions:write triggers:read triggers:write usage-records:read usage-records:write usage-summary:read usage-summary:write vaults:read vaults:write work-items:read work-items:write"
OIDC_RUNNER_CLIENT_ID = "01a01c2c-b25f-76fa-bc6f-edfc51f235e1"
OIDC_RUNNER_SCOPES = "openid profile email offline_access runners:read runners:write work-items:read work-items:write leases:read leases:write sessions:write"

[triggers]
crons = ["* * * * *"]

[ai]
binding = "AI"

[[ratelimits]]
name = "AUTH_CLIENT_RATE_LIMITER"
namespace_id = "89001"
simple = { limit = 10, period = 60 }

[[ratelimits]]
name = "AUTH_IP_RATE_LIMITER"
namespace_id = "89002"
simple = { limit = 100, period = 60 }

[[queues.producers]]
binding = "CLOUD_TURNS"
queue = "ama-cloud-turns"

[[queues.producers]]
binding = "TRIGGER_DISPATCHES"
queue = "ama-trigger-dispatches"

[[queues.consumers]]
queue = "ama-cloud-turns"
max_batch_size = 1
max_retries = 5
dead_letter_queue = "ama-cloud-turns-dlq"

# A cloud turn that keeps failing (infra / DB / queue errors) lands here after
# max_retries instead of being silently dropped, stranding the session. The DLQ
# consumer marks the session errored so clients recover. Provision the queue with
# `wrangler queues create ama-cloud-turns-dlq` before deploying.
[[queues.consumers]]
queue = "ama-cloud-turns-dlq"
max_batch_size = 1
max_retries = 1

[[queues.consumers]]
queue = "ama-trigger-dispatches"
max_batch_size = 1
max_retries = 5
dead_letter_queue = "ama-trigger-dispatches-dlq"

[[d1_databases]]
binding = "DB"
database_name = "any-managed-agents-db"
database_id = "1b821d59-c74b-47e4-9af3-3d83de81dc1c"
migrations_dir = "./migrations"

[[r2_buckets]]
binding = "SESSION_EVENTS"
bucket_name = "ama-session-events"

[[durable_objects.bindings]]
name = "SANDBOX"
class_name = "Sandbox"

[[durable_objects.bindings]]
name = "SESSION"
class_name = "SessionObject"

[[durable_objects.bindings]]
name = "RUNNER_POOL"
class_name = "RunnerPoolObject"

[[migrations]]
tag = "v1"
new_sqlite_classes = ["ManagedAgent"]

[[migrations]]
tag = "v2"
new_sqlite_classes = ["Sandbox"]

[[migrations]]
tag = "v3"
new_sqlite_classes = ["RunnerSessionChannelObject"]

# ManagedAgent (the agents-SDK chat DO) was never bound to a binding and is not
# the v1.0 runtime contract; the class is removed. The v1 tag stays as applied
# history; this migration drops the unused class.
[[migrations]]
tag = "v4"
deleted_classes = ["ManagedAgent"]

# The runner session channel DO is generalised into the per-session Session DO
# (browser transport + cloud event store + runner bridge). Rename preserves the
# existing sqlite-class lineage and any live instances; idFromName(sessionId)
# addressing is unchanged.
[[migrations]]
tag = "v5"
renamed_classes = [{ from = "RunnerSessionChannelObject", to = "SessionObject" }]

[[migrations]]
tag = "v6"
new_sqlite_classes = ["RunnerPoolObject"]

[[containers]]
class_name = "Sandbox"
name = "any-managed-agents-sandbox"
image = "./Dockerfile"
max_instances = 20

[observability]
enabled = true

[observability.traces]
enabled = true
head_sampling_rate = 0.05

[env.staging]
name = "any-managed-agents-staging"
routes = [
  { pattern = "enbor-staging.realmroot.dev", custom_domain = true },
]

[env.staging.vars]
RUNTIME_MODE = "live"
SANDBOX_TRANSPORT = "rpc"
AI_GATEWAY_ID = "enbor"
OIDC_ISSUER = "https://id.realmroot.dev/api/auth"
OIDC_RESOURCE = "https://enbor-staging.realmroot.dev/api"
OIDC_BROWSER_SCOPES = "openid profile email agents:read agents:write audit-records:read audit-records:write auth:read auth:write budgets:read budgets:write connectors:read connectors:write environments:read environments:write identities:read identities:write leases:read leases:write memory-stores:read memory-stores:write projects:read projects:write providers:read providers:write runners:read runners:write sessions:read sessions:write triggers:read triggers:write usage-records:read usage-records:write usage-summary:read usage-summary:write vaults:read vaults:write work-items:read work-items:write"
OIDC_RUNNER_CLIENT_ID = "01a01c2c-b25f-76fa-bc6f-edfc51f235e1"
OIDC_RUNNER_SCOPES = "openid profile email offline_access runners:read runners:write work-items:read work-items:write leases:read leases:write sessions:write"
ALLOWED_ORIGINS = "https://enbor-staging.realmroot.dev,https://enbor-staging.saltbo.workers.dev"

[env.staging.triggers]
crons = ["* * * * *"]

[env.staging.ai]
binding = "AI"

[[env.staging.ratelimits]]
name = "AUTH_CLIENT_RATE_LIMITER"
namespace_id = "89003"
simple = { limit = 10, period = 60 }

[[env.staging.ratelimits]]
name = "AUTH_IP_RATE_LIMITER"
namespace_id = "89004"
simple = { limit = 100, period = 60 }

[[env.staging.queues.producers]]
binding = "CLOUD_TURNS"
queue = "enbor-cloud-turns-staging"

[[env.staging.queues.producers]]
binding = "TRIGGER_DISPATCHES"
queue = "enbor-trigger-dispatches-staging"

[[env.staging.queues.consumers]]
queue = "enbor-cloud-turns-staging"
max_batch_size = 1
max_retries = 5
dead_letter_queue = "enbor-cloud-turns-staging-dlq"

[[env.staging.queues.consumers]]
queue = "enbor-cloud-turns-staging-dlq"
max_batch_size = 1
max_retries = 1

[[env.staging.queues.consumers]]
queue = "enbor-trigger-dispatches-staging"
max_batch_size = 1
max_retries = 5
dead_letter_queue = "enbor-trigger-dispatches-staging-dlq"

[[env.staging.d1_databases]]
binding = "DB"
database_name = "enbor-db-staging-v2"
database_id = "68036380-0b48-4ed4-95c6-a1cc001e4a64"
migrations_dir = "./migrations"

[[env.staging.r2_buckets]]
binding = "SESSION_EVENTS"
bucket_name = "enbor-session-events-staging"

[[env.staging.durable_objects.bindings]]
name = "SANDBOX"
class_name = "Sandbox"

[[env.staging.durable_objects.bindings]]
name = "SESSION"
class_name = "SessionObject"

[[env.staging.durable_objects.bindings]]
name = "RUNNER_POOL"
class_name = "RunnerPoolObject"

[[env.staging.containers]]
class_name = "Sandbox"
name = "any-managed-agents-staging-sandbox"
image = "./Dockerfile"
max_instances = 20

[env.e2e]
routes = []

[env.e2e.vars]
SANDBOX_TRANSPORT = "rpc"
OIDC_ISSUER = "https://oidc.test/api/auth"
OIDC_CLIENT_ID = "enbor-e2e"
OIDC_RUNNER_CLIENT_ID = "enbor-runner-e2e"
OIDC_RUNNER_SCOPES = "openid profile email offline_access"
ALLOWED_ORIGINS = "http://localhost:5173"
E2E_TEST_AUTH = "true"
E2E_FAKE_REALMROOT_ENROLLMENT = "true"
RUNTIME_MODE = "test"
VAULT_ENCRYPTION_KEY = "e2e-local-vault-encryption-key-not-for-production"
WEB_SESSION_ENCRYPTION_KEY = "e2e-local-web-session-key-not-for-production"
OIDC_CLIENT_SECRET = "e2e-local-confidential-client-secret"

[env.e2e.triggers]
crons = []

[env.e2e.ai]
binding = "AI"

[[env.e2e.ratelimits]]
name = "AUTH_CLIENT_RATE_LIMITER"
namespace_id = "89005"
simple = { limit = 10, period = 60 }

[[env.e2e.ratelimits]]
name = "AUTH_IP_RATE_LIMITER"
namespace_id = "89006"
simple = { limit = 100, period = 60 }

[[env.e2e.d1_databases]]
binding = "DB"
database_name = "enbor-db-staging-v2"
database_id = "68036380-0b48-4ed4-95c6-a1cc001e4a64"
migrations_dir = "./migrations"

[[env.e2e.r2_buckets]]
binding = "SESSION_EVENTS"
bucket_name = "enbor-session-events-staging"

[[env.e2e.durable_objects.bindings]]
name = "SANDBOX"
class_name = "Sandbox"

[[env.e2e.durable_objects.bindings]]
name = "SESSION"
class_name = "SessionObject"

[[env.e2e.durable_objects.bindings]]
name = "RUNNER_POOL"
class_name = "RunnerPoolObject"

[[env.e2e.containers]]
class_name = "Sandbox"
name = "enbor-e2e-sandbox"
image = "./Dockerfile"
max_instances = 1