Pick any line to see why it is the way it is: the commit, the pull request and issue it came from, and what the agent was thinking.
| The sidebar asks billing whether it is on, not for the account, so no page waits on the card processor | 1 | { |
| 2 | "$schema": "../../node_modules/wrangler/config-schema.json", | |
| 3 | "name": "g1t-sudo", | |
| 4 | "account_id": "1e6f2cffa3f445920836e8ebe446bb58", | |
| 5 | "compatibility_date": "2026-09-26", | |
| 6 | "placement": { "mode": "off" }, | |
| 7 | "main": "./workers/app.ts", | |
| 8 | // Staff only: reachable at sudo.g1t.sh, behind Cloudflare Access, and | |
| 9 | // nowhere else. No workers.dev address and no preview URLs, so there is | |
| 10 | // no way round Access to the worker. | |
| 11 | "routes": [{ "pattern": "sudo.g1t.sh", "custom_domain": true }], | |
| 12 | "workers_dev": false, | |
| 13 | "preview_urls": false, | |
| 14 | // Even the stylesheet goes through the worker, which checks the Access | |
| 15 | // token on every request before anything is served. | |
| 16 | "assets": { "binding": "ASSETS", "run_worker_first": true }, | |
| 17 | // Billing's and identity's staff-only methods (admin_*). Nothing else | |
| 18 | // binds to identity's admin_* methods. The event log, read-only, for | |
| 19 | // `abuse.flagged` (Abuse & fraud). | |
| 20 | "services": [ | |
| 21 | { "binding": "BILLING", "service": "g1t-billing" }, | |
| 22 | { "binding": "IDENTITY", "service": "g1t-identity" }, | |
| 23 | { "binding": "EVENTS", "service": "g1t-events" }, | |
| 24 | // The status page's staff-only entrypoint: posting incidents to | |
| 25 | // status.g1t.sh (apps/status). Only bindings reach it. | |
| Merge branch 'main' into actions-toolkit-oidc-artifacts | 26 | { "binding": "STATUS", "service": "g1t-status", "entrypoint": "StatusAdmin" }, |
| 27 | // "Check for new models" on Agents & models: the model proxy's | |
| 28 | // `Discovery` entrypoint lists each provider's models now and records | |
| 29 | // them with billing's catalogue. Only bindings reach it. | |
| 30 | { "binding": "MODELS", "service": "g1t-models", "entrypoint": "Discovery" } | |
| The sidebar asks billing whether it is on, not for the account, so no page waits on the card processor | 31 | ], |
| 32 | "vars": { | |
| 33 | // The Zero Trust team domain, such as `g1t.cloudflareaccess.com`. | |
| 34 | "ACCESS_TEAM_DOMAIN": "syntaqx.cloudflareaccess.com", | |
| 35 | // The Access application's Audience (AUD) tag. | |
| 36 | "ACCESS_AUD": "5479fcf84130fc7ae68c207ae69a81b2aa17d97714443c6f1dddd058c530b8cf", | |
| 37 | // Who may use sudo, comma separated. Access lets them in; this | |
| 38 | // decides again, in case the Access policy is ever widened. | |
| sudo: Access service tokens listed in STAFF_SERVICE_TOKENS are staff, recorded as <name>@service.g1t.sh | 39 | "STAFF_EMAILS": "syntaqx@gmail.com, @g1t.sh", |
| 40 | // Access service tokens let in as staff: `<client id>=<name>`, comma | |
| 41 | // separated. Each acts, and is recorded, as `<name>@service.g1t.sh`. | |
| 42 | // The Access application needs a Service Auth policy including it. | |
| 43 | "STAFF_SERVICE_TOKENS": "434297ede60761875e84742d0486cf27.access=claude" | |
| The sidebar asks billing whether it is on, not for the account, so no page waits on the card processor | 44 | }, |
| Merge branch 'worktree-agent-a8752162fea25f63f' into spend-guardrails | 45 | // Every log kept: staff only, few requests. |
| 46 | "observability": { "enabled": true, "head_sampling_rate": 1 }, | |
| The sidebar asks billing whether it is on, not for the account, so no page waits on the card processor | 47 | "upload_source_maps": true |
| 48 | } |
This file's history is long; its oldest lines are credited to the oldest commit read.