{
	"$schema": "node_modules/wrangler/config-schema.json",
	"name": "nucleic-runner",
	"main": "src/index.ts",
	"compatibility_date": "2026-06-01",
	"observability": {
		"enabled": true
	},
	// One Durable Object per runner pool (placement, caps, fencing) and one per container slot.
	"durable_objects": {
		"bindings": [
			{
				"name": "NUCLEIC_RUNNER_POOLS",
				"class_name": "RunnerPool"
			},
			{
				"name": "NUCLEIC_RUNNER_CONTAINERS",
				"class_name": "RunnerContainer"
			}
		]
	},
	"migrations": [
		{
			"tag": "v1",
			"new_sqlite_classes": [
				"RunnerPool",
				"RunnerContainer"
			]
		}
	],
	// The runner image: nucleic-sandbox + nucleicd (containers/nucleic-runner/Dockerfile),
	// built + pushed by .github/workflows/runner-image.yml (static amd64 nucleicd, boot-smoked
	// against the deployed relay). Uncomment once BOTH publish jobs have run on a branch CI
	// builds from: sandbox-image.yml (the base's linux/amd64 variant — ANTIMATTER_RUNNER §0.2
	// item 3a) and runner-image.yml (this image, item 3b). A private GHCR package also needs
	// `wrangler containers registries configure ghcr.io` once. Until then deploys go out
	// without the containers block; `npm run check` stays green either way.
	"containers": [
	// 	{
			"class_name": "RunnerContainer",
 			"image": "ghcr.io/abkslm/nucleic-runner:v1",
	 		"max_instances": 16,
	 		"instance_type": "standard"
	 	}
	],
	// Enroll challenges, pool credential hashes, revocations.
	// Create with `wrangler kv namespace create NUCLEIC_RUNNER_TOKENS` and paste the id.
	"kv_namespaces": [
		{
			"binding": "NUCLEIC_RUNNER_TOKENS",
			"id": "70ea23d5c582444587d560ffc785dd7b"
		}
	],
	"routes": [
		{
			"pattern": "runner.nucleic.blakeslee.xyz",
			"custom_domain": true
		}
	]
	// Secrets (wrangler secret put):
	//   RUNNER_TOKEN_SECRET   HMAC key for instance tokens (32+ random bytes)
	//   RUNNER_ADMIN_SECRET   operator override bearer (inspection/revocation)
	//   RUNNER_WAKE_SECRET    relay-presence wake hook bearer (same value on the edge Worker;
	//                         unset ⇒ POST /v1/hook/wake answers 501)
}
