| 1 | import type { DiffineryEvent } from "@diffinery/shared"; |
| 2 | import type { RepoDO } from "./repo/RepoDO.js"; |
| 3 | import type { SchedulerDO } from "./scheduler.js"; |
| 4 | import type { ComposeDO } from "./compose.js"; |
| 5 | import type { ImportContainer } from "./imports/container.js"; |
| 6 | import type { RunnerContainer, SandboxContainer } from "./runner/containers.js"; |
| 7 | import type { MailJob } from "./mail/types.js"; |
| 8 | import type { ProjectDO } from "./agentic/ProjectDO.js"; |
| 9 | import type { ExportJob } from "./accounts/export.js"; |
| 10 | import type { DeletionCleanup } from "./accounts/lifecycle.js"; |
| 11 | |
| 12 | export interface Env { |
| 13 | DB: D1Database; |
| 14 | BUCKET: R2Bucket; |
| 15 | EVENTS: Queue<DiffineryEvent>; |
| 16 | REPO: DurableObjectNamespace<RepoDO>; |
| 17 | /** Fires workflow schedules (src/scheduler.ts). */ |
| 18 | SCHEDULER: DurableObjectNamespace<SchedulerDO>; |
| 19 | /** Joins the blocks of large artifact and cache uploads, a step per object (src/compose.ts); without it RepoDO does. */ |
| 20 | COMPOSE?: DurableObjectNamespace<ComposeDO>; |
| 21 | /** Minutes between scheduler ticks, 1 to 60 (default 5, GitHub's shortest schedule interval). */ |
| 22 | SCHEDULE_TICK_MINUTES?: string; |
| 23 | /** End-to-end tests only: how long one minute of an environment's wait timer lasts, in ms (default 60000). */ |
| 24 | WAIT_TIMER_MINUTE_MS?: string; |
| 25 | /** End-to-end tests only: how often a running agent task is polled, in ms (default 3000, at least 200). */ |
| 26 | AGENT_POLL_MS?: string; |
| 27 | /** End-to-end tests only: how often open web terminals are checked, in ms (default 60000, at least 2000). */ |
| 28 | TERMINAL_POLL_MS?: string; |
| 29 | RUNNER: DurableObjectNamespace<RunnerContainer>; |
| 30 | /** Smaller hosted runners (runner/sizes.ts); a deployment without one runs those jobs on RUNNER. */ |
| 31 | RUNNER_MEDIUM?: DurableObjectNamespace<RunnerContainer>; |
| 32 | RUNNER_SMALL?: DurableObjectNamespace<RunnerContainer>; |
| 33 | RUNNER_TINY?: DurableObjectNamespace<RunnerContainer>; |
| 34 | SANDBOX: DurableObjectNamespace<SandboxContainer>; |
| 35 | /** One per repository: its agent tasks (agentic/ProjectDO.ts). */ |
| 36 | PROJECT: DurableObjectNamespace<ProjectDO>; |
| 37 | /** |
| 38 | * Local development and end-to-end tests only: sandboxes run in one `agent.mjs --sandbox-pool` |
| 39 | * process at this URL instead of Cloudflare Containers (which don't run under `wrangler dev`). |
| 40 | */ |
| 41 | SANDBOX_POOL_URL?: string; |
| 42 | SANDBOX_POOL_SECRET?: string; |
| 43 | /** `off` switches web terminals (agentic/terminals.ts) off for the whole instance; on by default. */ |
| 44 | TERMINALS?: string; |
| 45 | /** Local development and end-to-end tests only: where the model proxy forwards instead of the providers' APIs. */ |
| 46 | MODEL_UPSTREAM_ANTHROPIC?: string; |
| 47 | MODEL_UPSTREAM_OPENAI?: string; |
| 48 | MODEL_UPSTREAM_OPENROUTER?: string; |
| 49 | RUN_WORKFLOW: Workflow<{ repoId: string; runId: string }>; |
| 50 | /** Cloudflare Email Sending. Missing when sending isn't set up; emails are then logged as skipped. */ |
| 51 | EMAIL?: SendEmail; |
| 52 | /** Request rate limits (lib/rate-limit.ts); none in local development. */ |
| 53 | RL_AUTH?: RateLimit; |
| 54 | RL_ANON?: RateLimit; |
| 55 | RL_ACCOUNT?: RateLimit; |
| 56 | RL_CREATE?: RateLimit; |
| 57 | /** Model requests through the proxy, per paying person (agentic/proxy.ts). */ |
| 58 | RL_MODEL?: RateLimit; |
| 59 | /** Email jobs, sent by the queue consumer in mail/send.ts. */ |
| 60 | MAIL?: Queue<MailJob>; |
| 61 | IMPORT_WORKFLOW: Workflow<{ importId: string }>; |
| 62 | /** Account exports and the background part of deleting an account (accounts/workflow.ts). Missing in unit tests, which run the work at once. */ |
| 63 | ACCOUNT_WORKFLOW?: Workflow<ExportJob | DeletionCleanup>; |
| 64 | /** GitHub imports copy Git data in this container (absent under `wrangler dev`). */ |
| 65 | IMPORTER?: DurableObjectNamespace<ImportContainer>; |
| 66 | /** "external": an import agent started outside the Worker claims the Git transfer (local development and tests). */ |
| 67 | IMPORT_GIT_AGENT?: string; |
| 68 | /** Default per-account quotas (lib/quotas.ts); -1 is unlimited. Site administrators override them per account. */ |
| 69 | QUOTA_HOSTED_MINUTES?: string; |
| 70 | QUOTA_HOSTED_JOBS?: string; |
| 71 | QUOTA_SANDBOXES?: string; |
| 72 | QUOTA_REPOSITORIES?: string; |
| 73 | QUOTA_STORAGE_BYTES?: string; |
| 74 | /** Hosted Actions jobs the whole instance runs at once (lib/quotas.ts fleetLimits); keep it under the runner classes' max_instances. */ |
| 75 | HOSTED_JOBS_LIMIT?: string; |
| 76 | /** "web": hosted jobs and sandboxes reach only HTTP, HTTPS and DNS (lib/egress.ts). Anything else, or unset, is open. */ |
| 77 | EGRESS?: string; |
| 78 | /** Largest source repository an import will take, in KB (GitHub `size`); default 10 GB. */ |
| 79 | IMPORT_MAX_REPO_KB?: string; |
| 80 | /** Optional GitHub OAuth app, for linking an account through the web flow instead of a gist. */ |
| 81 | GITHUB_OAUTH_CLIENT_ID?: string; |
| 82 | GITHUB_OAUTH_CLIENT_SECRET?: string; |
| 83 | |
| 84 | /** Canonical origin, e.g. https://diffinery.com */ |
| 85 | PUBLIC_URL: string; |
| 86 | /** Sender address for every email, e.g. notifications@diffinery.com. */ |
| 87 | MAIL_FROM?: string; |
| 88 | /** |
| 89 | * More places security researchers can report vulnerabilities, served in /.well-known/security.txt |
| 90 | * after the instance's own report form (/security/report): an email address or an https URL, several |
| 91 | * separated by commas. |
| 92 | */ |
| 93 | SECURITY_CONTACT?: string; |
| 94 | /** |
| 95 | * The proof record served at /.well-known/mcp-registry-auth (`v=MCPv1; k=ed25519; p=...`), so the |
| 96 | * instance's MCP server can be published to the official MCP registry under its own domain. |
| 97 | */ |
| 98 | MCP_REGISTRY_AUTH?: string; |
| 99 | /** Comma-separated emails that become site admins on first sign-in (logins are ignored). Deployed by scripts/bootstrap-admins.sh. */ |
| 100 | BOOTSTRAP_ADMINS: string; |
| 101 | /** e.g. example.cloudflareaccess.com — empty disables Access verification. */ |
| 102 | ACCESS_TEAM_DOMAIN: string; |
| 103 | /** Access application audience tag. */ |
| 104 | ACCESS_AUD: string; |
| 105 | /** Artifact storage per repository in bytes (live artifacts plus uploads in progress); default 10 GiB. */ |
| 106 | ARTIFACT_QUOTA_BYTES?: string; |
| 107 | /** The runner image the deploy pointed containers at, as jobs report it (scripts/render-config.mjs). */ |
| 108 | RUNNER_IMAGE?: string; |
| 109 | /** |
| 110 | * "off" stops telling search engines about new and changed public pages through IndexNow (web/indexnow.ts). |
| 111 | * Unset, it is on whenever PUBLIC_URL is a public https origin and MASTER_KEY is set. |
| 112 | */ |
| 113 | INDEXNOW?: string; |
| 114 | /** The deployed version (wrangler.jsonc version_metadata): IndexNow checks the site's pages once per new version. */ |
| 115 | CF_VERSION_METADATA?: WorkerVersionMetadata; |
| 116 | /** Local development only: act as this email when Access is not configured. */ |
| 117 | DEV_AUTH?: string; |
| 118 | /** |
| 119 | * "open": anyone can create an account at /signup by confirming an emailed code (auth/signup.ts). |
| 120 | * Anything else, or unset, keeps the instance invite-only. |
| 121 | */ |
| 122 | SIGNUP?: string; |
| 123 | /** |
| 124 | * Cloudflare Turnstile widget on the sign-up page and the security report form; open sign-up and |
| 125 | * reports from people who aren't signed in need it and TURNSTILE_SECRET outside local development. |
| 126 | */ |
| 127 | TURNSTILE_SITE_KEY?: string; |
| 128 | |
| 129 | /** Secret: base64 32 bytes; root key for envelope encryption of secrets and for the links and tokens Diffinery signs. */ |
| 130 | MASTER_KEY?: string; |
| 131 | /** |
| 132 | * Secret, set only while rotating MASTER_KEY: the key it replaced. Secrets sealed and links or tokens |
| 133 | * signed with it keep working; everything new uses MASTER_KEY (lib/crypto.ts). |
| 134 | */ |
| 135 | MASTER_KEY_PREV?: string; |
| 136 | /** Secret: ES256 private JWK (JSON) used to sign OIDC tokens for jobs. */ |
| 137 | OIDC_PRIVATE_KEY?: string; |
| 138 | /** Secret: signs bounce and complaint events posted to /-/email/events (mail/events.ts); unset, that endpoint is off. */ |
| 139 | MAIL_EVENTS_SECRET?: string; |
| 140 | /** Secret: Cloudflare Turnstile secret key, to check the widget on the sign-up page and the security report form (siteverify). */ |
| 141 | TURNSTILE_SECRET?: string; |
| 142 | /** Optional GitHub Enterprise host (e.g. github.example.com) the importer may download release assets from. */ |
| 143 | IMPORT_GHE_HOST?: string; |
| 144 | } |