AGENTS.md@public/files/anarlog/apps/api git:20260915.997c05bA

Immutable. This exact content is served forever at /api/v1/blob/76f94534dbb70d77.

```bash
infisical export \
  --env=dev \
  --secret-overriding=false \
  --format=dotenv \
  --output-file="apps/api/.env" \
  --projectId=87dad7b5-72a6-4791-9228-b3b86b169db1 \
  --path="/anarlog/ai"
```

`/anarlog/ai` is the API runtime view. Its Nango entries should reference the
source secrets in `/anarlog/nango` rather than requiring API jobs to export a
second secret path.

## Service runtimes

`ANARLOG_SERVICE` selects the routes started by the shared API binary:

| Value | Routes |
| --- | --- |
| `all` (default) | Existing combined API, preserving current client URLs |
| `ai` | Transcription, LLM, research, diarization, and STT callbacks |
| `sync` | Sync, devices, attachments, sharing, hosted meeting API/MCP |
| `core` | Nango and integration APIs, account deletion, SCIM |
| `billing` | Trial/subscription API under the existing `/subscription`, `/rpc`, and `/billing` aliases |

The billing image uses the `billing-runtime` Docker target: one Machine runs
the Rust API and the existing `apps/stripe` webhook handler and seat worker.
Rust exposes `/webhook/stripe`, preserving signed bytes through a loopback hop
to port 8788. Only the billing role may enable `ANARLOG_BILLING_WEBHOOKS`.
Readiness at `/health/ready/billing-unified` requires the local webhook listener.
The deployment profile deliberately uses that path so pre-consolidation Rust-only
images cannot pass readiness during rollback. Retain a known combined billing
image for rollback after moving the Stripe destination. The Bun supervisor drains Rust
requests before stopping webhooks and awaiting claimed seat work.
Billing secrets include DATABASE_URL and STRIPE_WEBHOOK_SECRET from
`/anarlog/stripe-sync`; LOOPS_API_KEY comes from the API view LOOPS_KEY.
Core retains the existing subscription configuration for account deletion and SCIM.

All roles require Supabase configuration. Only `ai` and `all` require
`OPENROUTER_API_KEY` and `API_BASE_URL`; the sync runtime requires its shared-note
email configuration. Optional integration groups are validated only in their
owning roles. `ANARLOG_ATTACHMENT_BACKUP_GC_ENABLED` is accepted only by `core`
and `all`. Assign cleanup to one deployment during migration.

Role selection does not change Fly routing or provision applications. Keep
existing URLs working while clients and webhook providers migrate.

Standalone profiles are `fly.ai.toml` (`anarlog-inference`),
`fly.sync.toml` (`anarlog-sync`), `fly.core.toml` (`anarlog-core`), and
`fly.billing.toml` (`anarlog-billing-api`). The default `fly.toml` and
`fly.gateway.toml` route public and legacy custom domains through `anarlog-ai`
to these services. Keep domain certificates and DNS routing on this shared gateway.
Core owns durable cleanup; other profiles disable it. Never transfer cleanup
ownership until the previous owner's worker has stopped.

`/health/ready/{service}` verifies the expected runtime role, configuration of
its primary subsystems, and that it is not draining. The combined role uses
`api`; Rust billing uses `billing-api`. These checks do not probe external
providers or prove request continuity. Keep dependency smoke tests and active
traffic deploy/rollback tests as separate rollout gates.

The drain deploy helper reconciles the supported single-process Fly profile
into each candidate. Unsupported settings fail before machine mutations;
extend its translation and tests before introducing additional Fly features.


The combined compatibility runtime can forward each role through
`ANARLOG_AI_ORIGIN`, `ANARLOG_SYNC_ORIGIN`, `ANARLOG_CORE_ORIGIN`, and
`ANARLOG_BILLING_ORIGIN`. Unset origins keep the existing local route behavior.
The proxy preserves uploads, response streams, and WebSocket upgrades; it does
not retry writes or follow redirects. Drain permits cover proxied requests and
upgraded connections through completion. Origins are rejected in standalone
roles to prevent routing cycles.

`api_cd.yaml` selects one explicit service per dispatch. `gateway` retains the
existing public URLs with its forwarding profile; deploy and verify all
standalone services before activating this profile. The default dispatch is
`gateway`. The optional `image` input accepts only an immutable API image digest.
Keep the image and configuration together in the rollout record. Explicit drain
adoption requires independent verification that the exact image handles SIGUSR1;
health alone does not establish that capability. Secrets are filtered by the
selected runtime before staging. Core's checked-in profile enables cleanup so
routine deployments preserve worker ownership.