{
  "$schema": "node_modules/wrangler/config-schema.json",
  // DEV deployment only (workers.dev, no custom domain). Deploy:
  //   wrangler deploy -c wrangler.dev.jsonc
  // Secrets (wrangler secret put -c wrangler.dev.jsonc, never here): VERCEL_TOKEN, SANDBOX_DEV_JWKS,
  // EGRESS_DEV_STATIC_AUTHORIZATION, CONTROL_PLANE_TOKEN (same value as on
  // orca-billing-dev), GITHUB_APP_ID, GITHUB_APP_PRIVATE_KEY (PKCS#8), SECRETS_KEK (base64 32 bytes),
  // OPERATOR_TOKEN (/v1/internal/*), GITHUB_STATE_SECRET; for the GitHub connect flow also
  // GITHUB_APP_CLIENT_ID + GITHUB_APP_CLIENT_SECRET (app settings → generate a client secret).
  "name": "orca-sandbox-control-dev",
  "main": "src/index.ts",
  "compatibility_date": "2026-11-01",
  "workers_dev": true,
  // Preview aliases (wrangler versions upload --preview-alias) must stay reachable for pre-merge VM tests.
  "preview_urls": true,
  "d1_databases": [
    {
      "binding": "SANDBOX_DB",
      "database_name": "orca-sandbox-control-dev",
      "database_id": "e9f259e9-94b3-4e18-a132-2d807693a498",
      "migrations_dir": "migrations"
    }
  ],
  // ENV-STALE: each golden build's orcad bundle; booting sandboxes behind the active golden install it.
  "r2_buckets": [{ "binding": "RUNTIME_BUNDLES", "bucket_name": "orca-sandbox-runtime-dev" }],
  // Same-account Workers cannot call each other over workers.dev (error 1042); BILLING_URL names the origin.
  "services": [{ "binding": "BILLING", "service": "orca-billing-dev" }],
  // Every minute for routines (src/routines); the rest of the cron work runs on minute % 5 == 0.
  // Environment builds advance on Durable Object alarms (EnvironmentBuildRunner), not on readers. The
  // runner is its own Worker (wrangler.build-runner.dev.jsonc, deployed first): a Worker implementing a
  // Durable Object gets no preview URLs. v2 deletes the class this Worker hosted until then; its only
  // state was each build's alarm, and the cron below re-arms every unfinished build within a minute.
  // v2 below was applied in a deploy with no binding (Cloudflare error 10061 refuses a delete-class migration
  // while any binding names the class, even one with script_name); the binding now points at the runner Worker.
  "durable_objects": {
    "bindings": [{ "name": "ENV_BUILD_RUNNER", "class_name": "EnvironmentBuildRunner", "script_name": "orca-sandbox-build-runner-dev" }]
  },
  "migrations": [
    { "tag": "env-build-runner-v1", "new_sqlite_classes": ["EnvironmentBuildRunner"] },
    { "tag": "env-build-runner-v2", "deleted_classes": ["EnvironmentBuildRunner"] }
  ],
  "triggers": { "crons": ["* * * * *"] },
  "vars": {
    "SANDBOX_ENV": "dev",
    // Flag S1 (contract D10/D11): Claude via the person's Orca account. Dev only until Neil's S1 sign-off.
    "AGENT_ACCOUNTS_CLAUDE": "on",
    // Flag S2: Codex via the account broker (broker sandbox, lease refresher, placeholder auth.json). Dev only
    // until Neil's S2 sign-off; the kill switch is AGENT_ACCOUNTS_CODEX_DISABLED=1.
    "AGENT_ACCOUNTS_CODEX": "on",
    "SANDBOX_POOL_SIZE": "2",
    // Dev only (ignored unless SANDBOX_ENV is dev): these dev accounts hit the real billing gate.
    "SANDBOX_DEV_BILLING_ENFORCE_PREFIX": "dev:billing-test-",
    // The golden orcad tracks this branch (host RPCs ship there first); rebuilt when HEAD touches VM code.
    "GOLDEN_IMAGE_SOURCE": "git:https://github.com/nwparker/orca-private#cloud/integration",
    "SANDBOX_JWT_AUDIENCE": "orca-sandbox",
    "SANDBOX_JWKS_URL": "https://login.onorca.dev/.well-known/jwks.json",
    "SANDBOX_AUTH_ISSUER": "https://login.onorca.dev",
    // Dev only: also trust Orca Cloud auth STAGING sandbox tokens (billing dev trusts staging too).
    "SANDBOX_STAGING_JWKS_URL": "https://auth-staging.onorca.dev/.well-known/jwks.json",
    "SANDBOX_STAGING_AUTH_ISSUER": "https://auth-staging.onorca.dev",
    "VERCEL_TEAM_ID": "team_c5IO9DfEYAxKEUgMxrbEtO0a",
    "VERCEL_PROJECT_ID": "prj_SkVtv6zJurF9dUHpfTRy4v9avwPq",
    "VERCEL_REGION": "pdx1",
    "VERCEL_FALLBACK_REGIONS": "iad1",
    "BILLING_URL": "https://orca-billing-dev.lovecast.workers.dev",
    // Golden image from image/build-golden-image.ts; lifecycle routes answer 503 without one.
    "GOLDEN_SNAPSHOT_ID": "snap_vpcmcCAgTtISiTZgsCosOlThQbFd",
    // Snapshots are region-locked: the seed is an iad1 image; pdx1 builds its first image from source.
    "GOLDEN_SNAPSHOT_REGION": "iad1",
    "GITHUB_APP_SLUG": "orca-cloud-dev",
    // Cloud setup pages (staging auth): GitHub installs started from a setup session return there.
    "CLOUD_SETUP_ORIGIN": "https://auth-staging.onorca.dev",
    "EGRESS_PROXY_URL": "https://orca-sandbox-control-dev.lovecast.workers.dev/v1/egress/proxy"
  }
}