Worker bindings & secrets

ADMINISTRATOR ::: danger Restricted

:::

The Worker pms-system-builder is configured in wrangler.jsonc. Account 9dac569398e062114feee83bf22f9636, email [email protected].

Bindings

Type	Variable	Resource
D1	DB	pms-db (4e00e088-b574-4f81-9b0c-bd41c6264034)
D1	RAG_DB	rag-corpus
R2	BACKUPS	bucket pms
Vectorize	VEC	(account-scoped)
Queue producer	CHAIN_C_STEPS_QUEUE	chain-c-steps
Queue consumer	(binding)	chain-c-steps (DLQ chain-c-steps-dlq)
AI	AI	Workers AI
Asset bucket	ASSETS	static SPA

Vars (non-secret)

Var	Value
EMBEDDING_MODEL	(per wrangler.jsonc)
GITHUB_REPO_OWNER	getsov75-maker (added v2.30.0)

Secrets

Already set — do NOT re-set without reason

Re-setting a secret invalidates every running edge worker until propagation finishes (~30 s). Only rotate when explicitly required.

Secret	Purpose
CLAUDE_API_KEY	Anthropic API
GOOGLE_AI_KEY	Gemini
PERPLEXITY_API_KEY	Perplexity Sonar
MOONSHOT_API_KEY	Kimi (rotated 2026-04-23)
Z_API_*	DEAD — instance suspended, kept only because removal triggers a redeploy
GITHUB_REPO_TOKEN	For internal one-off workflows
POSTMARK_TOKEN	Email mirror (Postmark Send Email API)

GitHub repo secrets

Secret	Purpose
MOONSHOT_API_KEY	Kimi remap workflow (rotated 2026-04-23)
CF_API_TOKEN	Wrangler deploy in CI (rotated 2026-04-23)
CF_ACCOUNT_ID	9dac569398e062114feee83bf22f9636
D1_DATABASE_ID	4e00e088-b574-4f81-9b0c-bd41c6264034

Cron triggers

*/10 * * * *   classifier sweep + watchdogs
0   3 * * *    R2 daily backup
0   4 * * *    R2 retention sweep (30-day)
0   2 * * *    RAG eval cron
0   * * * *    session GC

How to rotate a secret

# from repo root, with wrangler authed to the right account
wrangler secret put CLAUDE_API_KEY
# paste new value, hit Enter

# verify the worker is healthy
curl https://pmsplanner.com/api/health | jq .version

If the new key is wrong, the next AI-routed call will fail. Watch /api/ai-status for the failure spike, then re-rotate.