/// <reference types="@cloudflare/workers-types" />
/**
 * Canonical Cloudflare Worker binding interface.
 * All Workers and downstream specs type against this single source.
 * Binding names are load-bearing — they must match wrangler.toml EXACTLY.
 */
export interface Env {
  ENVIRONMENT?: 'development' | 'preview' | 'production'
  E2E_FIXTURE_SECRET?: string          // preview-only role-fixture lifecycle secret
  // Cloudflare bindings
  DB: Hyperdrive                       // Neon Postgres via Hyperdrive
  STORAGE: R2Bucket                    // file / attachment storage
  KV: KVNamespace                      // session cache, token revocation, counters
  QUEUE: Queue                         // async job dispatch
  AUDIT_QUEUE: Queue                   // tenant-audit-log: audit event queue
  REALTIME_QUEUE: Queue                // real-time-infrastructure: WS fan-out queue (zync-realtime)
  AI: Ai                               // Workers AI (OCR, categorization)
  DO_REALTIME: DurableObjectNamespace  // TenantRealtimeDO — per-tenant WS hub
  PWHASH_DO: DurableObjectNamespace    // PasswordHashDO — PBKDF2 derive offload (30s CPU)
  PWHASH_DO_SECRET: string            // secret gate for PasswordHashDO (wrangler secret put)
  AUTHWRITE_DO: DurableObjectNamespace // AuthWriteDO — login/signup/verify-email WRITE offload (30s CPU)
  AUTHWRITE_DO_SECRET: string         // secret gate for AuthWriteDO (wrangler secret put)
  RECURRING_ALARM_DO: DurableObjectNamespace  // RecurringInvoiceAlarmDO — self-rescheduling daily generator
  RECURRING_ALARM_SECRET: string      // secret gate for RecurringInvoiceAlarmDO (wrangler secret put)
  VECTORIZE: VectorizeIndex            // per-tenant RAG embeddings
  RATE_LIMITER_AUTH: RateLimit
  RATE_LIMITER_WEBHOOK: RateLimit
  RATE_LIMITER_EXPENSE_UPLOAD: RateLimit
  RATE_LIMITER_LEAD_FORM: RateLimit
  RATE_LIMITER_SEARCH: RateLimit       // search-completeness: 60 req/min/user
  ANALYTICS_ENGINE: AnalyticsEngineDataset
  // wave-12: api-usage-quota-ui — per-key request counter (Analytics Engine)
  API_USAGE: AnalyticsEngineDataset
  // Secrets (provided as Worker environment variables)
  JWT_SECRET: string
  // admin-impersonation: separate secret for impersonation JWTs
  IMPERSONATION_SECRET: string
  DATABASE_URL: string
  // auth-2fa: Firebase phone auth (SMS OTP transport)
  FIREBASE_API_KEY: string
  FIREBASE_PROJECT_ID: string
  CRON_SECRET: string
  FILE_SIGNING_KEY: string             // HMAC-SHA256 key for signed R2 file URLs (expenses-module)
  ADMIN_ENCRYPTION_KEY: string
  INTEGRATION_ENCRYPTION_KEY: string
  RESEND_API_KEY: string
  // Web Push VAPID keys (system-communications-notifications)
  // VAPID_PRIVATE_KEY: PKCS#8 P-256 private key, base64url-encoded
  // VAPID_PUBLIC_KEY:  Uncompressed P-256 public key, base64url-encoded
  VAPID_PRIVATE_KEY: string
  VAPID_PUBLIC_KEY: string
  ANTHROPIC_API_KEY: string
  OPENAI_API_KEY: string              // system-ai: OpenAI adapter
  GOOGLE_AI_API_KEY: string           // system-ai: Google Gemini adapter
  GOOGLE_OAUTH_CLIENT_ID: string
  GOOGLE_OAUTH_CLIENT_SECRET: string
  MICROSOFT_OAUTH_CLIENT_ID: string
  MICROSOFT_OAUTH_CLIENT_SECRET: string
  UNSUBSCRIBE_HMAC_KEY: string
  CF_CUSTOM_HOSTNAME_API_TOKEN: string
  CF_ANALYTICS_READ_TOKEN: string
  DATA_EXPORT_KEY: string
  // zync-subscription: payment adapter selector ('null' | 'stripe' | ...)
  ZYNC_PAYMENT_ADAPTER?: string
  // admin-reports-analytics: Cloudflare Analytics Engine SQL API
  CF_ACCOUNT_ID: string
  CF_ANALYTICS_DATASET?: string
  ADMIN_REPORTS_USD_ILS_RATE?: string
  // system-status-page: public status cache KV (30s TTL)
  STATUS_KV: KVNamespace
  // expenses-module R2 bucket for receipt images
  RECEIPTS_BUCKET: R2Bucket
  // expenses-module: expense processing queue producer (renamed from QUEUE in wave-6)
  EXPENSE_QUEUE: Queue
  // invoices-core (wave-6): R2 bucket for immutable HTML invoice snapshots
  INVOICE_SNAPSHOTS_BUCKET: R2Bucket
  // crm-support-center (wave-6): reply dispatch queue producer
  SUPPORT_REPLY_DISPATCH_QUEUE: Queue
  // unified-attachments (P065, wave-7): KV cache for signed R2 URLs (55-min TTL)
  ATTACHMENT_URL_CACHE?: KVNamespace
  // wave-11 leaf-C: public signing / proposal / catalog rate limiters
  RATE_LIMITER_SIGN: RateLimit
  RATE_LIMITER_PROPOSAL: RateLimit
  RATE_LIMITER_CATALOG: RateLimit
  // wave-11 leaf-C: portal-file-sharing R2 bucket
  PORTAL_FILES_BUCKET: R2Bucket
  // wave-12: kb-article-editor — CDN domain for publicly-readable embedded images
  // Format: "https://kb-images.example.com" (no trailing slash). Optional; falls
  // back to constructing a path from the R2 bucket's public domain if unset.
  KB_IMAGE_DOMAIN?: string
  // wave-12: invoice-payment-link-generation — HMAC-SHA256 key for stateless payment link tokens
  INVOICE_PAYMENT_LINK_KEY: string
  // wave-12: invoice-payment-link-generation — base URL for /pay/{token} links (e.g. https://app.zync.is)
  APP_BASE_URL?: string
  // wave-12: oauth-authorization-code — KV for token endpoint rate limiting (brute-force protection)
  RATELIMIT_KV: KVNamespace
  // wave-13: uniform-format-export — ITA software registration number assigned to Zync
  ZYNC_ITA_SOFTWARE_ID?: string
  // wave-13: invoice-email-history — HMAC secret for verifying Resend webhook signatures
  RESEND_WEBHOOK_SECRET?: string
}