{
  // Cloudflare account that owns every Worker and provisioned resource.
  // Find it: https://developers.cloudflare.com/fundamentals/account/find-account-and-zone-ids/
  "accountId": "<CLOUDFLARE_ACCOUNT_ID>",

  // The deployment's public origin, used for PUBLIC_BASE_URL and to scope Context data.
  // null derives it from workers.router.route.customDomain.
  // Required when the router uses workersDev: the account's workers.dev subdomain is not
  // knowable from this file. Write it as a bare origin, no path and no trailing slash --
  // "https://<router-name>.<subdomain>.workers.dev".
  "publicBaseUrl": null,

  // Worker names are permanent service identities. Keep them unique within the account.
  // Reference: docs/customization.md#workers-and-routing
  "workers": {
    // Owns the public URL and serves the frontend. Proxies /api and /blueprint-screenshot to the
    // Workshop, and /gatekeeper/<name> to the matching Gatekeeper.
    "router": {
      "name": "<ROUTER_WORKER_NAME>",

      // Production: use a hostname in an active Cloudflare zone. Wrangler creates DNS and TLS.
      // Evaluation: replace this with "route": { "workersDev": true } and set publicBaseUrl above.
      // https://developers.cloudflare.com/workers/configuration/routing/custom-domains/
      "route": { "customDomain": "os.example.com" }
    },

    // The Workshop backend. No public route: the router reaches it over a service binding.
    "workshop": { "name": "<WORKSHOP_WORKER_NAME>" },
    "context": { "name": "<CONTEXT_WORKER_NAME>" },

    // The Scheduler Gatekeeper, which gives agents scheduled and recurring work. Ambient like
    // the Context Gatekeeper
    "scheduler": { "name": "<SCHEDULER_WORKER_NAME>" },

    // Upstream MCP connector, deployed by default. Users connect endpoints through the OS;
    // availability is controlled in admin -> Gatekeepers. No external storage or secrets required.
    "mcp": { "name": "<MCP_WORKER_NAME>" },

    "errorReporter": { "name": "<ERROR_REPORTER_WORKER_NAME>" }
  },

  // This starter deploys Cloudflare Access mode. Cloudflare OS also supports built-in password
  // accounts and auth Gatekeeper sign-in; see the reference below before switching. The audience
  // comes from the self-hosted Access application protecting the public hostname.
  // "admins" gates /admin in every sign-in method.
  // Reference: docs/customization.md#sign-in-methods
  "access": {
    "issuer": "https://<TEAM_NAME>.cloudflareaccess.com",
    "audience": "<ACCESS_AUDIENCE>",
    "admins": ["<ADMIN_EMAIL>"]
  },

  // Public core integration. Enable only in deployment.local.jsonc after review.
  // See docs/core-integration.md for Access path policies and event subscription setup.
  "core": {
    "enabled": false,
    "workerName": "<CORE_WORKER_NAME>",
    "hostname": "<CORE_HOSTNAME>",
    "mcpPath": "/mcp",
    "project": "<PROJECT_SLUG>",
    "artifactsNamespace": "<ARTIFACTS_NAMESPACE>",
    "oauthKvNamespaceId": null,
    "pushQueue": "<PUSH_QUEUE_NAME>",
    // Owner resolves this Queue name to its ID before provisioning the event-only token.
    "pushQueueId": "<PUSH_QUEUE_ID>",
    // Optional first-deploy JSON containing OWNER_API_TOKEN_HASH and CF_EVENTS_API_TOKEN.
    // Set an ignored owner file path locally, e.g. packages/forkhorse-core/.wrangler/deploy-secrets.json.
    // null uses secrets already installed on the Worker. --check never reads this file.
    "secretsFile": null,
    "deadLetterQueue": "<DEAD_LETTER_QUEUE_NAME>",
    "access": {
      "issuer": "https://<TEAM_NAME>.cloudflareaccess.com",
      "audience": "<CORE_ACCESS_AUDIENCE>",
      "owners": ["<OWNER_EMAIL>"]
    }
  },

  // Private GATEKEEPER_FORKHORSE replaces the starter sample in deployment and admin discovery.
  // Wiring grants no accounts or Git access; each user must connect an enrolled agent.
  // Set enabled false to omit this vendor entirely. Owner values stay in the local file.
  "forkhorseGatekeeper": {
    "enabled": true,
    "workerName": "<FORKHORSE_GATEKEEPER_WORKER_NAME>"
  },

  // Model catalog served through Cloudflare AI Gateway. Enabled by default: the Workshop reaches
  // the gateway over its WORKERS_AI binding, which is pre-authenticated inside your own account,
  // so no API token is needed.
  // Reference: docs/customization.md#ai-models
  "aiGateway": {
    "enabled": true,

    // Your account's AI Gateway. "default" is the one Cloudflare creates for the account.
    // Migrating from the hosted deploy? Use the gateway that flow created: "<instance>-ai"
    // (e.g. "cloudflareos-ai"), named after your instance. See docs/migrate-from-hosted.md.
    "name": "default",

    // null reuses the top-level accountId. Set only if the gateway lives in another account --
    // that requires CF_AI_GATEWAY_API_TOKEN, since the binding cannot reach across accounts.
    "accountId": null,

    // "cloudflare" is Workers AI, which needs no key of your own. anthropic/openai need keys
    // stored on the gateway; "google" additionally requires CF_AI_GATEWAY_API_TOKEN.
    "providers": ["cloudflare"]
  },

  "context": {
    // Isolates Context data shared by this Workshop deployment.
    // null scopes it to the public origin
    "sharingDomain": null,

    // null: Wrangler provisions and remembers a KV namespace on first deploy.
    // string: bind an existing namespace by ID.
    "kvNamespaceId": null

    // Optional Git-compatible storage for Context collections. To enable it, add a comma after
    // kvNamespaceId and uncomment this object. Requires Artifacts account access.
    // "artifacts": {
    //   "enabled": true,
    //   // Optional override; defaults to "gatekeeper-context-collections".
    //   "namespace": "custom-context-collections"
    // }
  },

  // Explicit backend issue reports go to a private Worker that emits structured console errors.
  // Set release to a commit/version when your deployment pipeline has one.
  // Reference: docs/observability.md#quick-start
  "errorReporting": {
    "enabled": true,
    "environment": "production",
    "release": null
  },

  // null values use Wrangler automatic provisioning. Set IDs/names to reuse owned resources.
  // https://developers.cloudflare.com/workers/wrangler/configuration/#automatic-provisioning
  "resources": {
    "blueprintsKvNamespaceId": null,
    "avatarsKvNamespaceId": null,
    "blueprintContentBucket": null
  },

  // Structured custom logs stay enabled. Invocation logs and traces are separate volume controls.
  // https://developers.cloudflare.com/workers/observability/logs/workers-logs/
  "observability": {
    "enabled": true,
    "headSamplingRate": 1,
    "logs": { "invocationLogs": false },
    "traces": { "enabled": false, "headSamplingRate": 0.1 }
  }
}