[stc93025mn]

Summary

Move the live dashboard plain var DOMAINS into wrangler.jsonc vars and remove keep_vars. Config owns plains; the list changes via PR.

Verified live Cloudflare setting (2026-09-28) for worker wkd-proxy-worker:

Changes

• Add vars.DOMAINS with that exact comma-separated list (no spaces).
• Remove keep_vars: true from wrangler.jsonc.
• Reverse AGENTS.md / CLAUDE.md / README so they say DOMAINS lives in wrangler vars and is changed via PR. Routes stay dashboard-managed.

Intentionally unchanged

• Dashboard routes and DNS.
• Secrets. No wrangler secret put, no secret values.
• Workers Builds settings. package.json deploy:cloudflare is still wrangler deploy --keep-vars (Builds command left as-is). After this lands, that flag does not protect or override DOMAINS because config vars always apply.
• No bare wrangler deploy.

Why keep_vars existed

Git history matches the hypothesis. #55 omitted example DOMAINS from Wrangler because keep_vars still applies any vars present in wrangler.jsonc, and an earlier example list overwrote production. #54 introduced keep_vars so Builds would not clobber the dashboard list. Putting the live list in config is the intended end state; keep_vars is no longer needed for DOMAINS.

Cloudflare docs treat the Wrangler file as the source of truth for plains. keep_vars only exists to preserve dashboard vars that are absent from config.

Verification

Local checks on this branch (Node v22.14.0):

• pnpm run typecheck — pass
• pnpm run coverage — 17/17 tests pass, 100% statements/branches/functions/lines
• pnpm run lint — pass
• pnpm run format:check — pass
• pnpm cf:check (wrangler deploy --dry-run) — pass; bindings include env.DOMAINS from wrangler vars; dry-run exited without deploying

  

[stc93025mn]

Closing: this public repo must not commit production DOMAINS. The list stays a Cloudflare Worker secret / dashboard value, not git. Replacement PR incoming (drop keep_vars, document secret DOMAINS, no real domains in source).