# ─────────────────────────────────────────────────────────────────────────
# WHAT BELONGS IN THIS FILE — and what does NOT
#
# This file is for the DEPLOYMENT'S OWN identity and its model keys. That is
# all. Provider credentials do NOT live here.
#
#   HERE, in .env
#     LEAFMESH_LICENSE_KEY, LEAFMESH_ENV_TOKEN
#     the ports, REDIS_* / Postgres  (the store the vault itself lives in)
#     your model provider key(s): OPENAI_API_KEY / ANTHROPIC_API_KEY /
#       GOOGLE_API_KEY …  (these are read from the environment as the mesh
#       starts, so they must be here — the vault is read too late for them)
#
#   NOT HERE — in the VAULT, added on Studio's Infrastructure page
#     every channel credential  (Slack bot_token / signing_secret / app_token,
#       Teams, Discord, Cliq, WhatsApp, Email)
#     every connector credential (MCP, Zapier, Composio, n8n, custom)
#     Config then names it:  connection: "slack-workspace"
#
# Why it matters: since 2.4.180 the mesh REFUSES TO BOOT if it finds a
# provider credential written into config — and `${ENV_VAR}` does not help,
# because substitution happens before the check runs, so the check sees the
# token itself. `connection:` is the only path that works.
#
# Note: a value is EMPTY here, never a comment. `KEY=   # explanation` is read
# by python-dotenv as the COMMENT being the value.
# ─────────────────────────────────────────────────────────────────────────

# {{project_name}} environment variables

# Required
LEAFMESH_LICENSE_KEY=your-license-key-here    # Get yours at https://leafcraft.ai
OPENAI_API_KEY=your-key-here
REDIS_HOST=localhost
REDIS_PORT=6379
REDIS_PASSWORD=

# Alternative LLM Providers (uncomment to use)
# ANTHROPIC_API_KEY=your-anthropic-key
# GOOGLE_API_KEY=your-google-key
# DEEPSEEK_API_KEY=your-deepseek-key

# Microsoft Foundry / Azure AI (uncomment to use)
# AZURE_FOUNDRY_API_KEY=your-foundry-api-key
# AZURE_FOUNDRY_TOKEN=your-entra-id-token          # Alternative: Entra ID bearer token

# External Integrations (uncomment when needed)
# COMPOSIO_API_KEY=your-composio-key
# ZAPIER_NLA_API_KEY=your-zapier-key
# N8N_BASE_URL=http://localhost:5678
# N8N_API_KEY=your-n8n-key
# CREWAI_API_KEY=your-crewai-key
# LANGGRAPH_API_URL=http://localhost:8123
# LANGGRAPH_API_KEY=your-langgraph-key

# Webhooks (for human agent interface)
# WEBHOOK_OUTBOUND_URL=https://your-webhook-endpoint.com
# WEBHOOK_TOKEN=your-webhook-token
# WEBHOOK_AUTH_TOKEN=your-inbound-auth-token

# API Server
# Default port is 18820. Change if running multiple projects locally.
# LEAFMESH_API_PORT=18820

# Observability
# Observability auto-enables with a valid LEAFMESH_LICENSE_KEY.
# LEAFMESH_ENV_TOKEN is your unique environment key (from https://leafcraft.ai).
LEAFMESH_ENV_TOKEN=your-env-token-here

# ────────────────────────────────────────────────────────────────────────
# Optional security / hardening knobs
# All have safe defaults — uncomment only when you need to tune them.
# ────────────────────────────────────────────────────────────────────────

# X-API-Key auth middleware. Default in the SDK is ON — every request to
# the API server must carry a valid X-API-Key header (validated against
# the LeafCraft auth backend). For LOCAL DEVELOPMENT WITHOUT INTERNET or
# without a real LeafCraft account yet, set to 0 to disable the middleware
# entirely (no header required, no backend call, requests pass through).
# Never set =0 in production.
# LEAFMESH_AUTH_STRICT=1

# Cookie SameSite policy for SSE auth (HITL / evolution / trace streams).
# Default Lax = cookie sent only on same-site requests. Set to None when
# your frontend lives on a different host than the SDK (ADK Studio at
# app.example.com → SDK at api.example.com, or local dev with frontend
# on localhost:5173 → SDK on 127.0.0.1:18820). The SDK auto-flips
# Secure=true with None; loopback HTTP works because browsers treat
# 127.0.0.1 / localhost as secure contexts.
# LEAFMESH_SSE_COOKIE_SAMESITE=None

# OTel — span attribute redaction. Default ON (user input/output replaced
# with `<redacted bytes:N>` before export). Set to 0 to ship raw content
# (only for self-hosted OTel collectors with strict access control).
# LEAFMESH_OTEL_REDACT_PII=1

# OTel content redaction toggle for the prompt-builder guardrail. Off-switch
# for the BEGIN/END_USER_MESSAGE / BEGIN/END_TOOL_RESULT delimiters.
# LEAFMESH_DISABLE_PROMPT_GUARDRAIL=0

# Webhook hardening (HMAC + replay protection).
# Set to 1 to keep accepting body-only HMAC during a migration window.
# LEAFMESH_WEBHOOK_ALLOW_LEGACY_HMAC=0
#
# ── The tuning knobs below are NOT environment variables any more ──
# 2.4.131 moved them into configs/config.yaml, where they round-trip and
# show up in Studio. Setting them here does nothing at all — no error, no
# effect. Put them in the config instead:
#
#   limits:
#     webhook_replay_skew_s: 300
#     webhook_rate_limit_max: 60
#     webhook_rate_limit_window_s: 60
#     webhook_max_payload_bytes: 1048576      # 1 MiB
#     knowledge_max_ingest_total_bytes: 52428800   # 50 MiB
#     knowledge_query_rate_limit_max: 120
#     knowledge_query_rate_limit_window_s: 60
#     max_session_history_bytes: 1048576
#     max_parallel_tool_calls: 8
#
#   timeouts:
#     llm_hard_timeout_s: 300     # stops a stuck provider pinning an agent slot
#
#   scheduler:
#     cron_min_interval_seconds: 60   # schedules below this are rejected
#     misfire_grace_s: 60
#
#   runtime:
#     lease_seconds: 30           # raise to ~120 on a flaky remote Redis
#     lease_heartbeat_s: 10
#
# (knowledge_max_docs_per_ingest and knowledge_max_doc_bytes were removed
#  outright — there is no replacement for those two.)

# MCP subprocess allowlist (comma-separated absolute paths or basenames).
# Empty = warn-only at startup. Set to "*" for "any command" with explicit
# operator opt-in. Anything else acts as a strict allowlist.
# LEAFMESH_MCP_COMMAND_ALLOWLIST=

# Teams adapter — fail-closed by default. Set to 1 only for local development
# behind a tunnel (production must wire a Bot Framework JWT validator).
# LEAFMESH_TEAMS_ALLOW_UNVERIFIED=0

# Conversation history hard byte cap (per session) — moved to config in
# 2.4.131:  limits.max_session_history_bytes: 5242880   # 5 MiB

# Security headers.
# LEAFMESH_HSTS_ENABLED=1
# LEAFMESH_REFERRER_POLICY=no-referrer
# LEAFMESH_CSP="default-src 'none'; frame-ancestors 'none'; base-uri 'none'"
