{
	"$schema": "node_modules/wrangler/config-schema.json",
	"name": "nucleic-runner",
	"main": "src/index.ts",
	"compatibility_date": "2026-06-01",
	"observability": {
		"enabled": true
	},
	// One Durable Object per runner pool (placement, caps, fencing) and one per container slot.
	"durable_objects": {
		"bindings": [
			{
				"name": "NUCLEIC_RUNNER_POOLS",
				"class_name": "RunnerPool"
			},
			{
				"name": "NUCLEIC_RUNNER_CONTAINERS",
				"class_name": "RunnerContainer"
			}
		]
	},
	"migrations": [
		{
			"tag": "v1",
			"new_sqlite_classes": [
				"RunnerPool",
				"RunnerContainer"
			]
		}
	],
	// The runner image: nucleic-sandbox + nucleicd (containers/nucleic-runner/Dockerfile), built
	// + pushed to Cloudflare's own managed registry by .github/workflows/runner-image.yml (static
	// amd64 nucleicd, boot-smoked against the deployed relay, then `wrangler containers push`).
	// The managed registry needs NO `wrangler containers registries configure` and no pull
	// credentials — Cloudflare pulls it directly at deploy (GHCR is not a supported Cloudflare
	// Containers pull source, which is why this moved off GHCR). Gate: runner-image.yml must
	// publish registry.cloudflare.com/<acct>/nucleic-runner:v1 once before the first deploy that
	// includes this block (deploying before the image exists 404s). The multi-arch
	// nucleic-sandbox base (sandbox-image.yml, COVALENCE_RUNNER §0.2 item 3a) is this image's
	// build-time FROM only — pulled by Docker in CI, never by Cloudflare.
	//
	// NOTE on the tag: `wrangler deploy` diffs the container application by this reference
	// STRING, so deploying the mutable `:v1` verbatim after a re-push reports "no changes" and
	// rolls nothing out. Both deploy workflows therefore rewrite this line to the exact
	// `@sha256:` digest (runner-image.yml: the digest it just pushed; runner-deploy.yml: the
	// registry's current digest for the tag) before running `wrangler deploy`. The committed
	// tag is the human-readable source of truth for WHICH stream of images this Worker runs;
	// the digest pin is applied in CI only, never committed.
	"containers": [
		{
			"class_name": "RunnerContainer",
			"image": "registry.cloudflare.com/c0b8e2a01e80cd7106e0e98e96f5415f/nucleic-runner:v1",
			"max_instances": 16,
			"instance_type": "standard-2"
		}
	],
	// Enroll challenges, pool credential hashes, revocations.
	// Create with `wrangler kv namespace create NUCLEIC_RUNNER_TOKENS` and paste the id.
	"kv_namespaces": [
		{
			"binding": "NUCLEIC_RUNNER_TOKENS",
			"id": "70ea23d5c582444587d560ffc785dd7b"
		}
	],
	"routes": [
		{
			"pattern": "runner.nucleic.blakeslee.xyz",
			"custom_domain": true
		}
	]
	// Secrets (wrangler secret put):
	//   RUNNER_TOKEN_SECRET   HMAC key for instance tokens (32+ random bytes)
	//   RUNNER_ADMIN_SECRET   operator override bearer (inspection/revocation)
	//   RUNNER_WAKE_SECRET    relay-presence wake hook bearer (same value on the edge Worker;
	//                         unset ⇒ POST /v1/hook/wake answers 501)
}
