# Database
DATABASE_URL=postgresql+asyncpg://devops:devops@localhost:5432/devops_discovery

# Anthropic AI
ANTHROPIC_API_KEY=sk-ant-...

# Encryption key for stored credentials (generate with: python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())")
CREDENTIALS_ENCRYPTION_KEY=

# Report storage
REPORTS_DIR=./reports

# CORS — comma-separated list of allowed frontend origins
CORS_ORIGINS=http://localhost:5173,http://localhost:3000

# Server
HOST=0.0.0.0
PORT=8000

# Concurrency limits
# MAX_CONCURRENT_SCANS=3
# MAX_CONCURRENT_REPORTS=5
MAX_CONCURRENT_AGENT_RUNS=2

# Maximum bytes of resolved skill content injected into the agent's system
# prompt per remediation. Skills are sorted by length descending and truncated
# longest-first when total exceeds this budget.
SKILL_PROMPT_BUDGET_BYTES=8192

# Agent feature flag — set to False to disable the remediation agent endpoints
AGENT_FEATURE_ENABLED=True

# Post-scan AI enrichment (opt-in per customer via Customer.enable_scan_enrichment).
# Caps to prevent runaway LLM costs on large scans.
SCAN_ENRICHMENT_MAX_FINDINGS=50
SCAN_ENRICHMENT_MAX_TOKENS_PER_SCAN=50000

# CI-mode runner — the public URL the customer's CI pipeline uses to POST events
# back to BPS. Must be externally reachable over HTTPS in production.
# Example: PUBLIC_API_BASE_URL=https://bps.example.com
PUBLIC_API_BASE_URL=http://localhost:8000