# Visus-MCP Environment Configuration
# Copy this file to .env and fill in your values

# =======================================
# Cryptographic Configuration
# =======================================

# REQUIRED for production proof signatures.
# Generate: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
# Minimum length: 32 bytes (64 hex chars recommended)
# Rotate: on compromise, on personnel change, on annual audit cycle
VISUS_HMAC_SECRET=

# =======================================
# Audit Configuration
# =======================================

# DynamoDB audit table name
VISUS_AUDIT_TABLE=visus-audit-log

# AWS region for DynamoDB
AWS_REGION=us-east-1

# Set to "true" to make audit write failures propagate (fail-closed)
# Default "false" = fail-open (audit failure does not break tool call)
AUDIT_FAIL_CLOSED=false

# Set to "false" to disable audit logging (dev/test only)
VISUS_AUDIT_ENABLED=true

# =======================================
# Stateful Scan Configuration (optional)
# =======================================

# Enable multi-turn priming detection (default: false)
VISUS_STATEFUL_SCAN=true

# =======================================
# Browser Configuration (optional)
# =======================================

# Fetch timeout in milliseconds
VISUS_TIMEOUT_MS=10000

# Max content size before truncation (in KB)
VISUS_MAX_CONTENT_KB=512

# =======================================
# Lambda Configuration (Hosted tier only)
# =======================================

# Lambda function ARN (set by CDK)
# LAMBDA_FUNCTION_ARN=

# API Gateway endpoint (set by CDK)
# API_GATEWAY_ENDPOINT=

# Cognito User Pool ID (set by CDK)
# COGNITO_USER_POOL_ID=

# Cognito App Client ID (set by CDK)
# COGNITO_APP_CLIENT_ID=