{
	"$schema": "node_modules/wrangler/config-schema.json",
	"name": "nucleic-edge",
	"main": "src/index.ts",
	"compatibility_date": "2026-06-01",
	"observability": {
		"enabled": true
	},
	"vars": {
		"RUNNER_WAKE_URL": "https://runner.nucleic.blakeslee.xyz/v1/hook/wake"
	}
	// Phase A — DAI (daily active installs) heartbeat sink, indexed by the anonymous install UUID.
	// Counts installs, not users (one person on Mac + iPhone = two). Query via the AE SQL API:
	//   SELECT toStartOfDay(timestamp) d, blob1 platform, count(DISTINCT index1) dai
	//   FROM nucleic_dai WHERE timestamp > now() - INTERVAL '30' DAY GROUP BY d, platform
	//
	// Relay DAU — a true daily-active-*user* count, indexed by roomId (≈ host identity / account):
	//   SELECT toStartOfDay(timestamp) d, count(DISTINCT index1) dau
	//   FROM nucleic_relay_dau WHERE timestamp > now() - INTERVAL '30' DAY GROUP BY d
	"analytics_engine_datasets": [
		{
			"binding": "NUCLEIC_DAI",
			"dataset": "nucleic_dai"
		},
		{
			"binding": "NUCLEIC_RELAY_DAU",
			"dataset": "nucleic_relay_dau"
		}
	],
	// Phase B — one Durable Object per relay room (WebSocket hibernation; SQLite-backed class).
	"durable_objects": {
		"bindings": [
			{
				"name": "ROOMS",
				"class_name": "Room"
			}
		]
	},
	"migrations": [
		{
			"tag": "v1",
			"new_sqlite_classes": [
				"Room"
			]
		}
	],
	// NUCLEIC_RELAY_TOKENS = revocation denylist; NUCLEIC_PUSH_TOKENS = deviceId → APNS token;
	// NUCLEIC_TESTER_APPS = trusted-tester applications + email dedupe index + rate-limit counters.
	// Create each with `wrangler kv namespace create <BINDING>` and paste the returned id.
	"kv_namespaces": [
		{
			"binding": "NUCLEIC_RELAY_TOKENS",
			"id": "21bdc123f69d4215b09c251d585bc49d"
		},
		{
			"binding": "NUCLEIC_PUSH_TOKENS",
			"id": "5cc442cba64c4cc8a3dbe660928edb47"
		},
		{
			"binding": "NUCLEIC_TESTER_APPS",
			"id": "fa361cd3e8de4b45a5870ab78563aeb4"
		}
	],
	// Trusted-tester owner notification. The send_email binding is pinned to a single verified
	// destination, so the Worker can only ever mail the owner. Enable Email Routing on the
	// blakeslee.xyz zone and verify accounts@abkslm.com as a destination first (docs/CLOUD_INFRA.md).
	"send_email": [
		{
			"name": "OWNER_EMAIL",
			"destination_address": "accounts@abkslm.com"
		}
	],
	// Both custom domains hit this one Worker (path-based: /v1/* on api, /relay on relay).
	// Requires the blakeslee.xyz zone on this account.
	"routes": [
		{
			"pattern": "api.nucleic.blakeslee.xyz",
			"custom_domain": true
		},
		{
			"pattern": "relay.nucleic.blakeslee.xyz",
			"custom_domain": true
		}
	]
	// Secrets (wrangler secret put):
	//   RELAY_TOKEN_SECRET   HMAC key for relay tokens
	//   RELAY_ADMIN_SECRET   bearer the host presents to mint/revoke/push
	//   APNS_KEY_P8          PKCS#8 PEM of the APNS .p8 auth key
	//   APNS_KEY_ID, APNS_TEAM_ID, APNS_TOPIC (xyz.blakeslee.nucleic-remote), APNS_ENV (sandbox|production)
	//   TESTER_APP_SECRET    HMAC key for the trusted-tester Approve/Reject links (32+ random bytes)
	//   TURNSTILE_SECRET     (optional) Cloudflare Turnstile secret to gate the apply form
	//   TESTER_FROM_ADDRESS  (optional) From address for the owner email; defaults to nucleic-testers@nucleic.blakeslee.xyz
}
