wrangler.toml

name = "passkey-kit-relayer-proxy"
main = "src/index.ts"
compatibility_date = "2024-12-01"
compatibility_flags = ["nodejs_compat"]

# Per-IP Relayer API key custody. A Durable Object (one instance per client IP)
# serializes get-or-create so concurrent first-requests mint at most ONE key —
# the atomic get-or-create KV cannot provide (no CAS). No namespace id to
# provision; the class is bound directly.
[[durable_objects.bindings]]
name = "API_KEY_DO"
class_name = "ApiKeyStore"

[[durable_objects.bindings]]
name = "RATE_LIMIT_DO"
class_name = "RequestRateLimiter"

[[migrations]]
tag = "v1"
new_sqlite_classes = ["ApiKeyStore"]

[[migrations]]
tag = "v2"
new_sqlite_classes = ["RequestRateLimiter"]

# Raise the CPU limit for testnet's Friendbot-funding retry loop (up to 5
# minutes). Network wait time (fetch) does not count toward CPU time. Mainnet
# never retries, so it uses the default limit.
[limits]
cpu_ms = 300_000

[vars]
NETWORK = "testnet"
RELAYER_BASE_URL = "https://channels.openzeppelin.com/testnet"
STELLAR_RPC_URL = "https://soroban-testnet.stellar.org"
# Empty origins fail closed. Set this to the exact deployed demo origin before
# deployment (comma-separated when more than one origin is intentional).
ALLOWED_ORIGINS = "https://passkey-kit-demo.pages.dev"
# Explicit contract IDs are optional; approved instances are otherwise verified
# by their on-chain WASM hash through STELLAR_RPC_URL.
ALLOWED_WALLET_CONTRACT_IDS = ""
ALLOWED_WALLET_WASM_HASHES = "fdefad64b96837147e1c333e51f537b696eab925e9f147e63d597c04e3c903f0"
ALLOWED_WALLET_FUNCTIONS = "add_signer,update_signer,remove_signer,upgrade"
ALLOWED_DEPLOYER_ADDRESSES = "GC2C7AWLS2FMFTQAHW3IBUB4ZXVP4E37XNLEF2IK7IVXBB6CMEPCSXFO"
MAX_RESOURCE_FEE_STROOPS = "1000000"
RATE_LIMIT_WINDOW_SECONDS = "60"
RATE_LIMIT_PER_IP = "10"
RATE_LIMIT_GLOBAL = "100"
TESTNET_RETRY_BASE_DELAY_MS = "500"
TESTNET_RETRY_MAX_DELAY_MS = "5000"

# Testnet-only by policy: no mainnet relayer proxy. (A previous `[env.production]`
# / mainnet worker was intentionally removed — passkey-kit fee-sponsorship runs
# on testnet only, through OpenZeppelin Channels.)