// Typed Env contract for the araharah bot Worker (D-10/D-11).
// Secrets (D-15) are wrangler secrets / .dev.vars mirrors — never committed (D-17).

export interface Env {
  BOT_TOKEN: string; // wrangler secret (D-15) — Telegram Bot API token from @BotFather
  // WEBHOOK_SECRET MUST be a non-empty secret (D-15) — /telegram/webhook
  // fails closed at request time when missing/empty (WR-02), refusing all
  // deliveries rather than letting grammY's secret check degrade to
  // accept-everything.
  WEBHOOK_SECRET: string; // wrangler secret (D-15) — value Telegram echoes in X-Telegram-Bot-Api-Secret-Token
  chat_sessions: KVNamespace; // TTL-only namespace — first durable KV namespace (PRIV-02)
  // D-01 graph binary — the repo's FIRST R2 binding. A bucket, NEVER a KV
  // namespace (GE5: exactly one kv_namespaces). worker-router's loadGraph
  // memoizes the decoded graph per isolate; an absent/corrupt object
  // degrades honest (null → router-pending, D-03), never a crash. The
  // bucket itself (araharah-graphs) is fork provisioning, not a secret —
  // docs/ROAD-GRAPH.md owns the fork contract.
  ROAD_GRAPH: R2Bucket;
  // The deployed Mini App ORIGIN (public, not a secret) — used to build the
  // OPEN button's deep link. NOT derived from user input: the deep-link
  // origin is a configured value (RESEARCH §Security V4 — an unvalidated
  // origin would be an open redirect).
  MINI_APP_URL: string;
}