# ─── Server ───
PORT=3100
CHROMIUM_PATH=/usr/bin/chromium-browser
MAX_BROWSERS=3
MAX_SSE_SESSIONS=50
MAX_SSE_PER_IP=5
SSE_CONNECT_MAX_PER_WINDOW=30      # per IP
SSE_CONNECT_WINDOW_MS=60000

# ─── Agent Memory ───
MEMORY_DB_PATH=./data/memory.db    # SQLite database for agent memory

# ─── Auth ───
FREE_DAILY_LIMIT=10
FREE_WINDOW_MS=86400000            # Free-tier window in ms (default: 24h)
REDIS_URL=                          # Optional shared rate-limit backend (redis:// or rediss://)
API_KEYS=                          # Comma-separated manually provisioned keys
ADMIN_SECRET=                      # Secret for /admin/* endpoints
KEYS_FILE=./data/api-keys.json    # Persistent API key storage path

# ─── Stripe Billing ───
STRIPE_SK=                         # Stripe secret key (sk_live_... or sk_test_...)
STRIPE_WEBHOOK_SECRET=             # Stripe webhook signing secret (whsec_...)
STRIPE_WEBHOOK_IP_ALLOWLIST=       # Optional CSV of allowed source IPs for Stripe webhooks
CHECKOUT_LIMIT_PER_HOUR=5
DOMAIN=https://mcp.skills.ws      # Used for Stripe checkout success/cancel URLs

# ─── x402 Pay-per-call ───
X402_PRICE_USD=0.005
X402_RECEIVER=0x087ae921CE8d07a4dE6BdacAceD475e9080B2aDF
X402_MAX_TX_AGE_SECONDS=86400       # Reject stale txs older than this (default 24h)
X402_TX_CACHE_FILE=./data/x402-tx-cache.json
X402_TEST_MODE=0                    # 1 = OFFLINE TEST ONLY (ignored in production)

# ─── Security Tools (optional — tools degrade gracefully without these) ───
VT_API_KEY=                        # VirusTotal API key (free: 4/min, 500/day)
ABUSEIPDB_API_KEY=                 # AbuseIPDB API key (free: 1000/day)
ETHERSCAN_API_KEY=                 # Etherscan API key (free: 5/sec)