Anchorage API reference
    Preparing search index...

    The env bindings the composed Worker reads. A host's own Env extends this (its workers-typed D1Database/DurableObjectNamespace/Queue bindings satisfy these structural subsets) and adds whatever its hooks need.

    interface FlowsafeWorkerEnv {
        APPROVAL_ALLOW_SELF_DECISION?: string;
        APPROVAL_RETENTION_DAYS?: string;
        APPROVAL_SLA_SECONDS?: string;
        AUDIT_PROXY?: AuditProxyNamespaceLike;
        AUDIT_QUEUE?: AuditQueue<ApprovalAuditEvent | InfrastructureAuditEnvelope>;
        DB: ApprovalDatabase & SnapshotDatabase & DeploymentIdentityDatabase;
        DEPLOYMENT_IDENTITY_SECRET: string;
        DEPLOYMENT_TENANT: string;
        FLEET_AUDIT_PROXY?: "required";
        FLEET_AUDIT_PROXY_INGRESS?: "required";
        FLEET_DEPLOYMENT_SCRIPT?: string;
        FLEET_ENVIRONMENT?: string;
        FLEET_MAINTENANCE_CAPABILITIES?: "required";
        FLEET_MAINTENANCE_CAPABILITY_PUBLIC_KEY?: string;
        FLEET_RESOURCE_GROUP?: string;
        FLEET_RESOURCE_ROLE?: "platform-state";
        FLEET_SPEC_DIGEST?: string;
        HUB?: HubNamespaceLike<unknown>;
        MAINTENANCE: MaintenanceNamespaceLike;
        MAINTENANCE_ADMIN_SECRET?: string;
        NOTIFICATION_RETENTION_DAYS?: string;
        OUTBOUND_ENVIRONMENT?: string;
        OUTBOUND_POLICY_ID?: string;
        OUTBOUND_PROXY?: StateEgressBinding;
        OUTBOUND_PROXY_CREDENTIAL?: string;
        OUTBOUND_RESOURCE_GROUP_ID?: string;
        OUTBOUND_ROUTE_HOSTNAME?: string;
        OUTBOUND_STATE_SCRIPT_NAME?: string;
        OUTBOUND_TENANT_ID?: string;
        RUN_RETENTION_DAYS?: string;
        RUNNER: RunnerNamespaceLike;
        SCHEDULE_TRIGGER_RETENTION_DAYS?: string;
        START_IDEMPOTENCY_RETENTION_DAYS?: string;
        STREAM_TICKET_SECRET?: string;
        THREAD_RETENTION_DAYS?: string;
        THREAD_STATE_RETENTION_DAYS?: string;
    }
    Index

    Properties

    APPROVAL_ALLOW_SELF_DECISION?: string

    Separation-of-duties exemption (var). Unset or a false spelling = SoD on (default); true = every decider may self-decide; a comma-separated role list (e.g. admin or admin,reviewer) = only those roles. Any invalid value falls back to OFF (fail closed).

    APPROVAL_RETENTION_DAYS?: string

    Maintenance purges DECIDED approval records older than this (default 30 days).

    APPROVAL_SLA_SECONDS?: string

    Default SLA seconds for new approvals (var; default 14400 = 4h).

    Remote trusted-state Durable Object namespace used by external releases.

    Optional audit queue producer; delivery belongs to the control plane.

    D1: the approval store AND the Mastra snapshot table live here.

    DEPLOYMENT_IDENTITY_SECRET: string

    Per-deployment Worker-to-Durable-Object credential.

    DEPLOYMENT_TENANT: string

    Provisioning-stamped deployment tag; must match the D1 sentinel.

    FLEET_AUDIT_PROXY?: "required"

    Fleet-controlled marker: audit export must use the trusted state proxy.

    FLEET_AUDIT_PROXY_INGRESS?: "required"

    Fleet-controlled marker: this private Worker terminates audit proxy calls.

    FLEET_DEPLOYMENT_SCRIPT?: string

    Fleet-controlled logical release-family name for trusted audit attribution.

    FLEET_ENVIRONMENT?: string

    Fleet-controlled environment attribution for trusted state.

    FLEET_MAINTENANCE_CAPABILITIES?: "required"

    Fleet-controlled marker: maintenance routes relay one-shot capabilities.

    FLEET_MAINTENANCE_CAPABILITY_PUBLIC_KEY?: string

    Fleet Ed25519 public JWK used before external maintenance execution.

    FLEET_RESOURCE_GROUP?: string

    Fleet resource group stamped onto trusted state.

    FLEET_RESOURCE_ROLE?: "platform-state"

    Distinguishes the trusted state runtime from an external candidate.

    FLEET_SPEC_DIGEST?: string

    Optional fleet release identity returned only by authenticated maintenance routes.

    HUB?: HubNamespaceLike<unknown>

    Optional deployment hub Durable Object namespace for live streaming. Present together with STREAM_TICKET_SECRET => the composer mounts the stream stage and fans approval mutations out to the deployment hub; either absent => streaming stays unmounted and the client remains poll-only.

    Fixed-name singleton that owns deployment maintenance alarms.

    MAINTENANCE_ADMIN_SECRET?: string

    Dedicated control-plane credential for maintenance administration.

    NOTIFICATION_RETENTION_DAYS?: string

    Agent-inbox TTL in days. The purge duty reaps terminal mastra_notifications rows past this age (pending rows are never reaped — one may await a future deliverAt). UNSET/EMPTY/INVALID => the duty does not run and no notification ever expires (opt-in, like THREAD_RETENTION_DAYS — a durable inbox is meant to be readable until the host says otherwise).

    OUTBOUND_ENVIRONMENT?: string
    OUTBOUND_POLICY_ID?: string
    OUTBOUND_PROXY?: StateEgressBinding

    Named StateEgress service binding, present only on trusted state.

    OUTBOUND_PROXY_CREDENTIAL?: string

    Dedicated trusted-state credential for the shared outbound entrypoint.

    OUTBOUND_RESOURCE_GROUP_ID?: string
    OUTBOUND_ROUTE_HOSTNAME?: string
    OUTBOUND_STATE_SCRIPT_NAME?: string
    OUTBOUND_TENANT_ID?: string
    RUN_RETENTION_DAYS?: string

    Maintenance purges terminal run snapshots older than this (default 30 days).

    The runner DO namespace createDoRunTopology drives.

    SCHEDULE_TRIGGER_RETENTION_DAYS?: string

    Schedule-trigger history TTL in days. The purge duty reaps mastra_schedule_triggers rows past this age by their actualFireAt. UNSET/EMPTY/INVALID => the duty does not run (opt-in; a schedule's fire history is inspectable until the host sets a window). Schedule rows are standing config with no TTL; an authorized DELETE removes them, and deployment decommissioning removes any that remain.

    START_IDEMPOTENCY_RETENTION_DAYS?: string

    How long a spent idempotency key stays answerable after its run settled — the key-validity horizon (var; defaults to RUN_RETENTION_DAYS, and is floored at it).

    Set this ABOVE run retention when callers may retry a start later than this deployment keeps run summaries: until the horizon elapses such a retry is told ALREADY_SETTLED, and after it the same key reads as brand new and starts a second run.

    STREAM_TICKET_SECRET?: string

    Dedicated stream-ticket signing secret. Absent means no streaming.

    THREAD_RETENTION_DAYS?: string

    Agent-memory thread TTL in days (docs/agent-memory-isolation.md#thread-retention): the purge duty deletes threads untouched for longer than this, with their messages. UNSET, EMPTY, or INVALID => the duty does not run and no thread ever expires — the opt-in default, because a thread is a conversation a host means to keep, not a terminal run snapshot that is finished by definition. There is no safe number to pick on an operator's behalf here, so anything short of a number the operator actually named is answered by NOT deleting (a config-error line marks the invalid case). Unlike RUN_RETENTION_DAYS this var decides whether an irreversible delete happens at all, so it does not take numberVar's fallback — see optionalNumberVar in env-vars.ts.

    THREAD_STATE_RETENTION_DAYS?: string

    Thread-state TTL in days. The purge duty reaps mastra_thread_state rows (state-signal lanes + goals) untouched for longer than this. UNSET/EMPTY/INVALID => the duty does not run (opt-in; an active goal bumps updatedAt so it never ages out).