# Database Configuration (Neon PostgreSQL)
# Get your connection strings from: https://console.neon.tech
DATABASE_URL="postgresql://user:password@host-pooler.region.aws.neon.tech/dbname?sslmode=require"
DIRECT_URL="postgresql://user:password@host.region.aws.neon.tech/dbname?sslmode=require"

# Neon Auth Configuration
# Get these from your Neon Auth setup: https://neon.tech/docs/guides/neon-authorize
NEON_AUTH_BASE_URL="https://your-project.neonauth.region.aws.neon.tech/dbname/auth"
# Must be at least 32 characters (Neon Auth). Example: openssl rand -base64 32
NEON_AUTH_COOKIE_SECRET="paste-a-random-secret-at-least-32-chars-long"

# Encryption Key (64 hexadecimal characters)
# Generate with: openssl rand -hex 32
ENCRYPTION_KEY="generate-a-64-char-hex-key-here"

# Optional: Environment Configuration
NODE_ENV="development"
REQUIRE_AUTH="true"
ALLOW_DEBUG_ENDPOINTS="false"

# Optional: Rate Limiting
RATE_LIMIT_WINDOW_MS="60000"
RATE_LIMIT_MAX="100"
USER_RATE_LIMIT_MAX="50"
# Optional: distributed rate limiting for Vercel/serverless deployments
# UPSTASH_REDIS_REST_URL="https://your-redis.upstash.io"
# UPSTASH_REDIS_REST_TOKEN="..."

# Optional: CORS Configuration
# ALLOWED_ORIGINS="https://yourdomain.com,https://app.yourdomain.com"
# ALLOWED_PROXY_DOMAINS="api.openai.com,api.anthropic.com"

# Optional: public ModelHub URL used by BYOC OpenClaw deployments to call back
# into this API. Defaults to the request origin; set this when the origin is not
# publicly reachable (e.g. local dev), so the OpenClaw container on Render can reach it.
# MODELHUB_PUBLIC_URL="https://www.modelhub.com.br"

# Optional: Provider Configuration
# ENABLED_PROVIDERS="openai,anthropic,google"
# DISABLED_PROVIDERS="provider-to-disable"

# Optional: Duck.ai challenge runtime
# Local/dev default: browser via bundled Puppeteer.
# Vercel/serverless: set DUCKAI_BROWSER_WS_ENDPOINT for a remote Chromium provider.
# Unsafe legacy escape hatch only if you explicitly accept running remote challenge JS in Node:
# DUCKAI_CHALLENGE_RUNTIME="jsdom-dangerous"
# DUCKAI_ALLOW_UNTRUSTED_CHALLENGE_CODE="true"
# DUCKAI_BROWSER_WS_ENDPOINT="wss://..."
# DUCKAI_PUPPETEER_NO_SANDBOX="false"

# Optional: AI Provider API Keys (for shared credentials)
# OPENAI_API_KEY="sk-..."
# OPENGATEWAY_API_KEY="ogw_live_..."
# ANTHROPIC_API_KEY="sk-ant-..."
# GOOGLE_AI_STUDIO_API_KEY="..."
# GROQ_API_KEY="gsk_..."
# MISTRAL_API_KEY="..."
# COHERE_API_KEY="..."
# HUGGINGFACE_API_KEY="hf_..."
# OPENROUTER_API_KEY="sk-or-..."
# VERCEL_AI_GATEWAY_API_KEY="..."
# Opcional: URL do demo público (Gateway Chat sem chave). Padrão: ai-sdk-gateway-demo.labs.vercel.dev
# GATEWAY_LABS_BASE_URL="https://ai-sdk-gateway-demo.labs.vercel.dev"