# Example Wrangler config for the gated Claude BFF Worker.
# EXAMPLE ONLY, placeholders. Not deployed.

name = "claude-bff-example"
main = "worker.ts"
compatibility_date = "2026-06-01"

# Public, non-secret configuration:
[vars]
# --- StoreKit entitlement gate (active when both are set) ---
# Comma-separated bundle IDs your app(s) ship under.
ALLOWED_BUNDLE_IDS = "com.example.app"
# Optional: restrict to specific product IDs. Empty = accept any product.
ALLOWED_PRODUCT_IDS = ""
# Hex SHA-256 of the DER-encoded "Apple Root CA - G3" certificate.
# Obtain and verify from https://www.apple.com/certificateauthority/
APPLE_ROOT_CA_SHA256 = "PUT_THE_PINNED_FINGERPRINT_HERE"

# --- App Attest authenticity gate (active when both are set) ---
# Leave blank to run StoreKit only. Set both to require a genuine app instance.
APP_ATTEST_TEAM_ID = ""
APP_ATTEST_BUNDLE_ID = ""

# --- Proxy configuration ---
# Opt in to each upstream path the app may reach. Default is the Messages API.
ALLOWED_UPSTREAM_PATHS = "/v1/messages"
# Anthropic API version header.
ANTHROPIC_VERSION = "2023-06-01"

# Secret, never commit this; set it out of band:
#   wrangler secret put ANTHROPIC_API_KEY