wrangler.jsonc

apps/worker/wrangler.jsonc

1. {
2. "$schema": "node_modules/wrangler/config-schema.json",
3. "name": "meridian-dashboard",
4. "main": "src/index.ts",
5. "compatibility_date": "2026-08-24",
7. // Served on <name>.<account-subdomain>.workers.dev. Cloudflare Access
8. // protects workers.dev URLs, so no custom domain and no DNS change to
9. // meridiandisplay.example is required. That matters: the public site's zone is
10. // managed separately, and repointing it to serve an internal board would be
11. // real risk for no benefit.
12. //
13. // Preview URLs default to matching this setting. They are a second door to
14. // the same client data, so cover them in the same Access application or turn
15. // them off. Do not leave one protected and the other open.
16. "workers_dev": true,
18. // Cron: 11:00 UTC = 06:00 America/Chicago in CDT, 05:00 in CST.
19. //
20. // Cloudflare crons are UTC only, so this shifts by an hour twice a year. The
21. // page shows `syncedAt` in Meridian time, so a drifted run is visible rather than
22. // silent. If the winter hour matters, add a second trigger and let the
23. // duplicate run overwrite: it is idempotent.
24. "triggers": {
25. // Three crons; the Worker branches on which fired.
26. //
27. // The morning and 15-minute crons both run the full sync: statuses move
28. // all day, and a board showing the 6am numbers at 3pm is one people learn
29. // to distrust.
30. //
31. // The difference is history: only the 11:00 run records the day's row, so
32. // the day-over-day arrows keep comparing mornings instead of quarter-hours.
33. // See sync() in src/index.ts.
34. //
35. // What this costs: a couple of dozen upstream requests per sync (the Bitrix
36. // lead pages, a few Plinth pages, Ninety, the tracker tabs) plus the Gmail
37. // reads for the inbox. It costs no model spend: the written briefings come from a
38. // laptop, not from here.
39. //
40. // At 11:00 both patterns fire and Cloudflare invokes twice. That is
41. // harmless: every write here is idempotent, and the two runs compute the
42. // same numbers.
43. //
44. // The every-minute cron is the Sync now button's runner. ctx.waitUntil() in
45. // a fetch handler does not get the budget a scheduled one does, and a
46. // two-minute sync does not fit in it: run from the route, it is cut off
47. // with nothing written. So the button records a request and this cron runs
48. // it, in the context that can. It does nothing at all on the minutes there
49. // is no request pending, which is almost all of them.
50. "crons": ["0 11 * * 1-5", "*/15 * * * *", "* * * * *"]
51. },
53. "kv_namespaces": [
54. {
55. "binding": "DASHBOARD",
56. // Replace with the id printed by:
57. // wrangler kv namespace create DASHBOARD
58. "id": "00000000000000000000000000000000",
60. // A separate namespace for `wrangler dev --remote`, which refuses to start
61. // without one. That refusal is doing something useful: --remote runs on
62. // Cloudflare's edge with the real secrets, so without this a test sync
63. // would write real pages and a real inbox read into production KV and the
64. // team would be served whatever a half-finished experiment produced.
65. //
66. // With it, a remote dev run is fully live against Google, Bitrix, Plinth and
67. // Ninety (which is the point, since Worker secrets are the only copy of
68. // the Gmail key) while writing somewhere nobody is reading.
69. //
70. // wrangler kv namespace create DASHBOARD --preview
71. "preview_id": "11111111111111111111111111111111"
72. }
73. ],
75. // D1: the end-of-day note and the private list, and the only SQL on this
76. // board. Everything else the board owns is a JSON blob in KV; a note is a
77. // row a day per person, read back as a date range that must include the days
78. // with nothing in them, and that is a table (rule 14). See
79. // apps/worker/migrations/ for the reasoning in full.
80. //
81. // If `wrangler d1 create` is refused with "Authentication error [code:
82. // 10000]" while the printed OAuth scopes include d1:write, re-mint with
83. // `wrangler login`: the cached scope list is wrangler's own record, not
84. // Cloudflare's, and the two can disagree.
85. //
86. // The binding is optional in Env, and stays that way. A Worker that lacks
87. // this binding says the note store is not set up, in those words. It
88. // does not say "no notes written". An unconfigured store and an empty one are
89. // different facts and the board never renders them the same way.
90. "d1_databases": [
91. {
92. "binding": "CHECKINS",
93. "database_name": "meridian-checkins",
94. // Replace with the id printed by `wrangler d1 create meridian-checkins`.
95. "database_id": "00000000-0000-0000-0000-000000000000",
96. "migrations_dir": "migrations"
97. }
98. ],
100. "vars": {
101. // Widen if orders routinely run longer than this. Each extra day is more
102. // Plinth paging, and Plinth caps at 10 requests / 10 seconds.
103. "PLINTH_WINDOW_DAYS": "60",
105. // Who the Worker trusts to say who you are. Both come from the Access
106. // application; neither is a secret. The team domain is in every login URL
107. // and the AUD tag identifies an app, it does not authorise anything.
108. //
109. // Until both are set the Worker refuses every request. That is the intended
110. // order: it cannot verify an assertion it has no keys for, and a board
111. // carrying client names must not fall open while Access is half-configured.
112. //
113. // team domain Zero Trust > Settings > Custom Pages, or any login URL
114. // AUD tag Zero Trust > Access > Applications > (this app) > Overview
115. "ACCESS_TEAM_DOMAIN": "your-team.cloudflareaccess.com",
116. "ACCESS_AUD": "REPLACE_WITH_ACCESS_AUD_TAG",
118. "DEBUG": "false"
119. },
121. // Secrets are not in this file and must never be. Set them with:
122. // wrangler secret put NINETY_TOKEN
123. // wrangler secret put BITRIX_WEBHOOK_URL
124. // wrangler secret put PLINTH_API_KEY
125. //
126. // NINETY_TOKEN must belong to a company Owner or Admin. GET /todos/company
127. // returns 403 for every other role.
129. "observability": {
130. "enabled": true
131. }
132. }