wrangler.data.jsonc

{
  // Dedicated Postgres-serving Worker (ADR 0013). Deployed separately from the main
  // api.mjs Worker so the postgres.js driver + growing read surface don't eat the
  // main Worker's bundle budget. Reached only via the main Worker's DATA_API service
  // binding (no public routes of its own). Deploy: wrangler deploy -c wrangler.data.jsonc
  //
  // Also owns every write route into this same Postgres instance (#4771's
  // neurons-sync, subnet-hyperparams-sync, account-identity-sync,
  // subnet-identity-sync, health-checks-sync, health-uptime-rollup-sync,
  // subnet-snapshot-sync, rpc-usage-sync, subnet-locks-sync (#6638) -- see
  // workers/data-api.mjs's handle*Sync functions) -- each requires its own
  // secret, set via:
  //   wrangler secret put <NAME>_SYNC_SECRET -c wrangler.data.jsonc
  // (and, for the ones called from the main Worker's own cron rather than an
  // external GitHub Actions workflow, the SAME secret value on the main
  // Worker too -- see wrangler.jsonc.)
  //
  // #4984 Part 1's chain_alert_triggers CRUD (workers/data-api.mjs's
  // handleAlertTrigger* functions) needs three MORE secrets, none yet
  // provisioned on any deployment:
  //   wrangler secret put ALERT_TRIGGER_CREATE_TOKEN -c wrangler.data.jsonc
  //   wrangler secret put ALERT_TRIGGERS_INTERNAL_TOKEN -c wrangler.data.jsonc
  // (ALERT_TRIGGER_CREATE_TOKEN gates public trigger creation, anti-abuse,
  // like METAGRAPH_WEBHOOK_SUBSCRIPTION_TOKEN; ALERT_TRIGGERS_INTERNAL_TOKEN
  // gates the #4984 Part 2 evaluator's active-trigger list scan. There is no
  // third secret to provision here -- per-trigger owner tokens are minted
  // per row by the CREATE route itself, not a deployment secret.) Until
  // ALERT_TRIGGER_CREATE_TOKEN is set, POST /api/v1/alerts/triggers 503s;
  // the table/routes are otherwise fully live once this file's schema.sql
  // is applied.
  //
  // Wallet-signature login + self-serve fullnode/freemium API keys
  // (src/wallet-auth.mjs + workers/data-api.mjs's handleWallet*/
  // handleAccountKeys*/handleApiKeyVerify/handleAccountTierPromote
  // functions; Unkey is the actual key store since the 2026-07-19 rework --
  // src/unkey-client.mjs) need secrets + one plain var:
  //   wrangler secret put WALLET_SESSION_SECRET -c wrangler.data.jsonc
  //   wrangler secret put UNKEY_ROOT_KEY -c wrangler.data.jsonc
  //   wrangler secret put API_KEY_LOOKUP_INTERNAL_TOKEN -c wrangler.data.jsonc
  //   wrangler secret put ACCOUNT_TIER_PROMOTE_INTERNAL_TOKEN -c wrangler.data.jsonc
  // (WALLET_SESSION_SECRET signs the key-management session token;
  // UNKEY_ROOT_KEY must be scoped to ONLY this deployment's one Unkey API/
  // keyspace (UNKEY_API_ID below) with exactly api.<id>.{create,verify,
  // update,delete,read}_key -- never the account-wide api.*.* wildcard, and
  // never the account's default/master root key;
  // API_KEY_LOOKUP_INTERNAL_TOKEN gates the internal key-verify route the
  // fullnode RPC gate's validator calls -- the SAME value must also be set
  // on the main Worker, wrangler.jsonc, see that file's own comment;
  // ACCOUNT_TIER_PROMOTE_INTERNAL_TOKEN gates the ops-only tier-promotion
  // route, called manually after confirming out of band that an account
  // should move off the 'free' default -- no self-serve path to a higher
  // tier exists by design.) There is no invite-code gate anymore: every
  // wallet-connected account can self-serve a key immediately.
  // Until WALLET_SESSION_SECRET is set, POST /api/v1/auth/wallet/verify and
  // every /api/v1/keys route 503; the rpc_accounts/api_keys.account_id
  // schema is otherwise live once this file's schema.sql is applied.
  //
  // Chain-wide account balance snapshot (#6741/#6742, the balance-based
  // top-holder leaderboard epic's data tier) needs:
  //   wrangler secret put ACCOUNT_BALANCES_SYNC_SECRET -c wrangler.data.jsonc
  // Set on metagraphed-infra's account-balances data-refresh job too
  // (roles/data-refresh-cron's vault, same secret_var convention every
  // other sync job uses). Until set, POST /api/v1/internal/account-balances-sync
  // 503s; the account_balances table is otherwise live once this file's
  // schema.sql is applied.
  "$schema": "node_modules/wrangler/config-schema.json",
  "name": "metagraphed-data-api",
  // Sentry deploy-entry wrapper (metagraphed#6479/#6485), not the raw
  // handler -- see workers/data-api.sentry.mjs's own header for why this
  // can't be wrapped inline (breaks its existing tests, which import
  // workers/data-api.mjs directly and are unaffected by this).
  "main": "workers/data-api.sentry.mjs",
  // Reached only through the main Worker's DATA_API service binding. Wrangler
  // defaults workers.dev to enabled when a Worker has no public routes, so keep
  // both public and preview URLs disabled for this private data tier.
  "workers_dev": false,
  "preview_urls": false,
  "compatibility_date": "2026-06-06",
  "compatibility_flags": ["nodejs_compat"],
  // Auto-detected release for @sentry/cloudflare (workers/data-api.sentry.mjs's
  // own CF_VERSION_METADATA?.id read) -- Cloudflare's own per-deploy
  // version UUID, present on every deploy with no extra CI/build step
  // needed. upload_source_maps makes Wrangler generate + upload sourcemaps
  // for this Worker's own deploy.
  "version_metadata": {
    "binding": "CF_VERSION_METADATA",
  },
  "upload_source_maps": true,
  // Public identifier for this deployment's one Unkey API/keyspace -- not a
  // secret (see UNKEY_ROOT_KEY above for the actual credential), just an
  // opaque id every src/unkey-client.mjs call needs to scope its request to.
  "vars": {
    "UNKEY_API_ID": "api_2Dv8cVjrTSiD",
  },
  // Smart placement: run the Worker close to the Hyperdrive origin (self-hosted indexer
  // box Postgres, reached via Cloudflare Tunnel) to minimize the per-request DB round-trip,
  // not at the nearest edge to the client.
  "placement": { "mode": "smart" },
  // Full observability — logs AND traces (matches the main Worker).
  "observability": {
    "enabled": true,
    "head_sampling_rate": 1,
    "logs": {
      "enabled": true,
      "head_sampling_rate": 1,
      "invocation_logs": true,
    },
    "traces": {
      "enabled": true,
      "head_sampling_rate": 1,
    },
  },
  "hyperdrive": [
    {
      "binding": "HYPERDRIVE",
      "id": "2e989d5380044b57b57cb6481c18487e",
      "localConnectionString": "postgresql://postgres:postgres@localhost:5432/metagraphed",
    },
  ],
  // Wallet-login challenge nonces (ADR 0021, #6835, src/wallet-auth.mjs) --
  // the SAME namespace id as the main Worker's own METAGRAPH_CONTROL binding
  // (wrangler.jsonc), bound under the same name here so both Workers read/
  // write the identical KV namespace (Cloudflare namespaces can be bound to
  // multiple Worker scripts; this is not a second namespace).
  "kv_namespaces": [
    {
      "binding": "METAGRAPH_CONTROL",
      "id": "9c5577a3454d4830b2ffd2f83775efb1",
    },
  ],
  // Found by adversarial review (#4984 Part 3): ALERT_TRIGGER_CREATE_TOKEN
  // alone doesn't bound REQUEST VOLUME from a legitimate token holder --
  // every created row becomes a permanent per-event cost in AlerterHub's
  // O(active triggers) match scan. Namespace id is local to THIS Worker's
  // own bindings (Cloudflare's Workers-native rate-limiting API, not the
  // older account-wide Rate Limiting Rules product) -- reusing "1001" here
  // does not collide with wrangler.jsonc's own RPC_RATE_LIMITER using the
  // same id, since ratelimit namespaces are scoped per Worker script.
  // Skipped when unbound (local dev/CI), matching every other optional
  // rate-limiter's convention in this codebase.
  "ratelimits": [
    {
      "name": "ALERT_TRIGGER_CREATE_RATE_LIMITER",
      "namespace_id": "1001",
      "simple": {
        "limit": 10,
        "period": 60,
      },
    },
    // Wallet-login abuse control (ADR 0021, #6835) -- an unauthenticated
    // caller can hit challenge/verify before any session exists, so this is
    // keyed by client IP, same posture/figure as ALERT_TRIGGER_CREATE_RATE_LIMITER
    // above. Skipped when unbound (local dev/CI).
    {
      "name": "WALLET_AUTH_RATE_LIMITER",
      "namespace_id": "1002",
      "simple": {
        "limit": 10,
        "period": 60,
      },
    },
    // Per-account key-mint abuse control -- with no invite-code gate at all,
    // "you can sign in as this wallet" is the only bound on WHO can mint;
    // this is what stops one signed-in account from minting rows in a tight
    // loop (the same gap adversarial review found in
    // ALERT_TRIGGER_CREATE_TOKEN alone), keyed by account id rather than IP.
    // Skipped when unbound (local dev/CI).
    {
      "name": "ACCOUNT_KEYS_MINT_RATE_LIMITER",
      "namespace_id": "1003",
      "simple": {
        "limit": 10,
        "period": 60,
      },
    },
  ],
}