// Bindings + secrets for the nucleic-runner Worker. See docs/ANTIMATTER_RUNNER.md §8 and
// cloud/nucleic-runner/README.md for how each is provisioned.

export interface Env {
  /** One Durable Object per runner pool (poolId = sha256 of the provisioning device's static
   * key). Owns the instance registry, placement, the max-containers cap, and epoch fencing. */
  NUCLEIC_RUNNER_POOLS: DurableObjectNamespace;

  /** One Durable Object per container instance (Cloudflare Containers class). The pool drives
   * these; each wraps one container running nucleicd (the host-of-record, instance "host") or a
   * session sandbox ("sb-<n>"). */
  NUCLEIC_RUNNER_CONTAINERS: DurableObjectNamespace;

  /** Enroll challenges (`enroll-chal:<id>`, short TTL), pool credentials
   * (`poolauth:<poolId>` → sha256 of poolSecret), revocations (`revoked:<poolId>`), and the
   * relay-wake room registry (`room:<roomId>` → poolId, refreshed by host heartbeats). */
  NUCLEIC_RUNNER_TOKENS: KVNamespace;

  // Secrets (wrangler secret put)
  /** HMAC key the Worker signs/verifies instance tokens with. */
  RUNNER_TOKEN_SECRET?: string;
  /** Operator override bearer: pool inspection/revocation without the pool credential. */
  RUNNER_ADMIN_SECRET?: string;
  /** Shared secret the relay presents on `POST /v1/hook/wake` (docs/ANTIMATTER_RUNNER.md §3):
   * deliberately its own credential — the relay holds it and it grants exactly one power,
   * waking a pool's host container. Unset ⇒ the hook answers 501. Same value as the edge
   * Worker's RUNNER_WAKE_SECRET. */
  RUNNER_WAKE_SECRET?: string;
}
