src/env.ts

Functions

None: it only declares types or values.

Imports

It imports no other module of this repo. Imported by src/access-login.ts, src/access-sync.ts, src/approval-executor.ts, src/auto-merge-policy.ts, src/auto-merge-tick.ts, src/backup.ts, src/bench.ts, src/bing-webmaster.ts, src/complete-ci.ts, src/controls-perform.ts, src/controls-plan.ts, src/controls-token.ts, src/controls.ts, src/dcr.ts, src/deploy-outcomes.ts, src/digest.ts, src/doc-index.ts, src/fail-exemption.ts, src/gate-policy.ts, src/github/actions.ts, src/github/client.ts, src/github/contents.ts, src/github/dispatch.ts, src/github/pr-files.ts, src/github/prune.ts, src/github/refs.ts, src/github/releases.ts, src/github/search.ts, src/health.ts, src/inbox.ts, src/index.ts, src/job-breaker.ts, src/job-fact-check.ts, src/job-outcomes.ts, src/job-overlaps.ts, src/jobs-begin.ts, src/jobs-claim.ts, src/jobs-edit.ts, src/jobs-holder.ts, src/jobs-mirror.ts, src/jobs-park.ts, src/jobs-seat.ts, src/jobs-transition.ts, src/live-checks.ts, src/maintenance-branches.ts, src/maintenance-deploys.ts, src/maintenance-prs.ts, src/maintenance-releases.ts, src/maintenance.ts, src/manual-steps.ts, src/mcp-handler.ts, src/merge-resume.ts, src/merge-safety.ts, src/merge-units.ts, src/model-drift.ts, src/model-routing-pr.ts, src/namespace-delete-token.ts, src/namespace-delete.ts, src/operator-key.ts, src/ops-cloudflare-config.ts, src/ops-cloudflare.ts, src/ops-feed.ts, src/ops-hooks.ts, src/ops-packages.ts, src/ops-snapshot.ts, src/outcome-prs.ts, src/overnight-plan.ts, src/overnight.ts, src/policy-sign.ts, src/portal-actions.ts, src/portal-app.ts, src/portal-auth.ts, src/portal-claims.ts, src/portal-convergence.ts, src/portal-library.ts, src/portal-maintenance.ts, src/portal-overnight.ts, src/portal-packages.ts, src/portal-stale.ts, src/portal-trends.ts, src/pr-approvals.ts, src/public-code.ts, src/public-data.ts, src/public-stats.ts, src/push.ts, src/review.ts, src/routes.ts, src/routine-fire.ts, src/search-console.ts, src/secret-presence.ts, src/server.ts, src/shadow.ts, src/shared-code.ts, src/signed-docs.ts, src/signed-requests.ts, src/site-check.ts, src/site-convergence.ts, src/site-key.ts, src/site-operator.ts, src/site-repair.ts, src/site-reports.ts, src/site-watch.ts, src/skills-refresh.ts, src/stale-canon.ts, src/stale-jobs.ts, src/status.ts, src/supersede.ts, src/task-runs.ts, src/tick.ts, src/tools/docs.ts, src/trends.ts, src/unmapped-repos.ts, src/watcher-findings.ts, src/watcher-gather.ts, src/watcher.ts, src/whats-next.ts, src/workers-builds.ts.

Source

1import type { OAuthHelpers } from "@cloudflare/workers-oauth-provider";
2
3// The bindings and vars wrangler.jsonc.example declares (DB, APP_KV, OAUTH_KV, MEDIA,
4// AI_SEARCH, GITHUB_APP_CLIENT_ID) come from worker-configuration.d.ts, which
5// `npm run types` generates with `wrangler types` and test/env-types.test.ts holds to
6// the example in both directions. What is written here is what the config cannot say:
7// secrets, the OAuth provider the library injects, the optional assets binding, and the
8// build stamps. GITHUB_APP_CLIENT_ID is generated as the literal pinned id; it is widened to string
9// here so tests and the deploy check can hold other values.
10export interface Env extends Omit<GeneratedEnv, "GITHUB_APP_CLIENT_ID"> {
11  OAUTH_PROVIDER: OAuthHelpers;
12  OPERATOR_KEY_HASH: string;
13  COOKIE_ENCRYPTION_KEY: string;
14  // The MCP and Portal logins' upstream: Cloudflare Access for SaaS (OIDC),
15  // src/access-login.ts. Unset, the sign-in is closed; ADMIN_EMAIL unset admits nobody,
16  // co-owners included.
17  ACCESS_TEAM_DOMAIN?: string;
18  ACCESS_SAAS_CLIENT_ID?: string;
19  ACCESS_SAAS_CLIENT_SECRET?: string;
20  ADMIN_EMAIL?: string;
21  // Co-owners: comma-separated emails admitted exactly like ADMIN_EMAIL (src/auth.ts
22  // isAdminEmail), each recorded under its own verified email, `access:<email>`. A
23  // co-owner cannot change ADMIN_EMAIL or this list: both are set only in Cloudflare.
24  // Optional; unset or empty means no co-owners. Ignored while ADMIN_EMAIL is unset.
25  CO_OWNER_EMAILS?: string;
26  // The Watch Floor's Cloudflare read (src/ops-cloudflare.ts): a read-only API token
27  // with Account Analytics Read and Workers Scripts Read, and the account it reads.
28  // Unset, the deploy and error columns show no data and say why.
29  CF_OPS_TOKEN?: string;
30  CF_ACCOUNT_ID?: string;
31  // Capsid Admin's capsid_admin_set_site_key (src/site-key.ts): a token with Workers Scripts Edit, to
32  // set a site's key as a secret on its Worker and on Carrel. Apart from CF_OPS_TOKEN
33  // because it writes. Unset, capsid_admin_set_site_key mints nothing and says why.
34  CF_SECRETS_TOKEN?: string;
35  // The Access sync's write token (src/access-sync.ts): Access: Groups Write, Access: Users
36  // Read and Zero Trust: Seats Write on this account only. Capsid is its only holder
37  // (Dustin, 2026-10-09). Unset, POST /ops/access-sync answers 503 and calls nothing.
38  CF_ACCESS_SYNC_TOKEN?: string;
39  // Google Search Console's read (src/search-console.ts): a service account's whole JSON
40  // key, the account added as a Full user on each site's property. Unset,
41  // capsid_inspect_repo action search reads nothing and says why.
42  GSC_SERVICE_ACCOUNT_KEY?: string;
43  // Bing Webmaster Tools' read (src/bing-webmaster.ts): the API key from Bing Webmaster
44  // Tools' Settings, API access. Bing gives it no narrower scope, so the module calls only
45  // Get methods. Unset, capsid_inspect_repo action bing reads nothing and says why.
46  BING_WEBMASTER_API_KEY?: string;
47  // The dashboard app's built files (dashboard/dist), served under /portal/ only
48  // after the Portal's gate. Absent where no assets are configured.
49  ASSETS?: Fetcher;
50  // GitHub App. No pinned installation id: resolved per owner and repo.
51  GITHUB_APP_CLIENT_ID: string;
52  GITHUB_APP_PRIVATE_KEY: string;
53  // Stamped by scripts/deploy.mjs at deploy time, not committed.
54  BUILD_SHA?: string;
55  BUILD_DIRTY?: string;
56  BUILT_AT?: string;
57  // Root secret the job and policy signing key (src/signed-docs.ts) and the backup
58  // credential key (src/signed-requests.ts) are derived from. Named for the improve
59  // loop that first used it; renaming a Worker secret is a step only the seat can take.
60  IMPROVE_SCORE_SECRET?: string;
61  // The capsid-bench repo's signing key (src/bench.ts), the same value as its BENCH_KEY secret.
62  BENCH_SECRET?: string;
63  // The backup credential mint (src/signed-requests.ts): the temp-access-credentials
64  // token and the parent it derives from. Omitted from RepoEnv.
65  R2_TEMP_CRED_TOKEN?: string;
66  R2_ACCOUNT_ID?: string;
67  R2_BACKUP_PARENT_ACCESS_KEY_ID?: string;
68  // The watcher's red and green mail about a site's health (src/site-watch.ts): a
69  // send_email binding, the address it sends to and the one it sends from, all optional and set by the seat
70  // in wrangler.jsonc (docs/portal.md, "Site repairs"). Unset, nothing is mailed, the
71  // finding still opens in Incidents, and each pass says the mail was not sent.
72  // Each site's operator token is a secret named by that site's configuration
73  // (<NAME>_OPERATOR_TOKEN, src/site-operator.ts), read by name and never declared here.
74  // The per-connector DCR callbacks (src/dcr.ts): Gemini's and ChatGPT's exact
75  // redirect URIs, comma separated, set by the seat in wrangler.jsonc. Unset, only the
76  // fixed Grok and ChatGPT callbacks can register.
77  DCR_REDIRECT_URIS?: string;
78  EMAIL?: SendEmail;
79  // The daily digest (src/digest.ts) sends only when this var is "on", which the seat sets
80  // once Dustin has turned Email Routing on for the domain and verified ALERT_EMAIL.
81  EMAIL_ROUTING?: string;
82  // Phone alerts (src/push.ts, src/web-push.ts): the VAPID key that signs each Web Push,
83  // a P-256 private key as a JWK, put by scripts/vapid-keys.mjs. Unset, no alert is sent
84  // and the Portal's Settings says why.
85  VAPID_PRIVATE_KEY?: string;
86  ALERT_EMAIL?: string;
87  ALERT_FROM?: string;
88}
89
90// What the GitHub modules (src/github/) are handed: everything except the credentials
91// that mint backup read access, the Cloudflare read token (it can read Worker code), the
92// Access sync's write token and the key that signs phone alerts.
93export type RepoEnv = Omit<Env, "R2_TEMP_CRED_TOKEN" | "R2_BACKUP_PARENT_ACCESS_KEY_ID" | "CF_OPS_TOKEN" | "CF_ACCESS_SYNC_TOKEN" | "VAPID_PRIVATE_KEY">;
94
95// A grant's props: the email Access verified at sign-in. Grants issued before the move
96// to Access carry { id, login, name } from GitHub instead, fail the per-request email
97// check, and the client signs in again once.
98export interface Props extends Record<string, unknown> {
99  email: string;
100  // When Access verified that email, in milliseconds since the epoch, set at /callback.
101  // The admin server's step-up reads it (src/scope.ts STEP_UP): a risky admin action
102  // needs a sign-in this recent. A grant made before it was recorded carries none and
103  // reads as stale.
104  signed_in_at?: number;
105}