# Database — required
# PostgreSQL connection string
DATABASE_URL=postgresql://tradeai:tradeai_dev@localhost:5432/tradeai

# Redis — required
# Redis connection URL
REDIS_URL=redis://localhost:6379

# Solana RPC — required for live trading, optional for paper trading
# Get your API key at https://helius.xyz
HELIUS_API_KEY=your_helius_api_key
HELIUS_RPC_URL=https://mainnet.helius-rpc.com/?api-key=YOUR_KEY
HELIUS_WS_URL=wss://mainnet.helius-rpc.com/?api-key=YOUR_KEY

# APIs — optional for paper trading
# DexScreener base URL (no API key required)
DEXSCREENER_BASE_URL=https://api.dexscreener.com

# Trading mode — default: true (paper trading)
# Set to false to enable live trading (use with caution)
PAPER_TRADING=true

# Portfolio risk limits — optional, defaults shown
# Maximum fraction of portfolio deployed at once (0-1)
MAX_PORTFOLIO_EXPOSURE=0.8
# Daily loss limit as a percentage of portfolio (0-100).
# When cumulative realized losses hit this threshold all new trades are blocked
# until the next UTC day or until manually overridden via POST /risk/resume.
DAILY_LOSS_LIMIT_PERCENT=20
# Maximum tolerated slippage on any swap (0-100).
# If actual execution price deviates more than this from the quoted price
# the swap is aborted and a SlippageExceededError is thrown (live trading only).
MAX_SLIPPAGE_PERCENT=5

# Wallet — required for live trading, optional for paper trading
# Path to the AES-256-GCM encrypted keystore file
KEYSTORE_PATH=~/.tradeai/keystore

# EVM chains — optional, required for ethereum/base/arbitrum/bsc live trading
# Alchemy or Infura HTTP RPC endpoint for EVM chains
EVM_RPC_URL=
# Optional WebSocket endpoint for eth_subscribe (falls back to polling if not set)
EVM_WS_URL=
# 1inch DEX aggregator API key — required for live EVM swaps
# Get a key at https://portal.1inch.dev
ONEINCH_API_KEY=

# AI Sidecar — optional, enhances signals with sentiment and pattern analysis
# FastAPI Python service. Run: cd ai-sidecar && pip install -r requirements.txt && uvicorn app.main:app
AI_SIDECAR_URL=http://localhost:8000

# REST API — optional, disabled by default
# Set API_ENABLED=true to start the HTTP server and WebSocket stream
API_ENABLED=false
# Port the REST API listens on
API_PORT=3000
# API key for authentication. All routes except GET /health require the
# X-API-Key header when this is set. Leave empty to disable auth (local dev only).
API_KEY=
# Comma-separated list of allowed CORS origins.
# Leave empty to allow all origins (default, suitable for local dev).
# Example: API_CORS_ORIGINS=https://app.example.com,https://dashboard.example.com
API_CORS_ORIGINS=