# Required
ANTHROPIC_API_KEY=sk-ant-...

# CORS — comma-separated list of exact allowed origins
CORS_ORIGIN=https://no-code-model-trainer.vercel.app,http://localhost:3000
# Optional override for the project-scoped Vercel-preview regex (defaults to
# this project's *.vercel.app preview deployments only)
# CORS_ORIGIN_REGEX=https://no-code-model-trainer[a-z0-9-]*\.vercel\.app

# Per-user run quotas (issue #29) — enforced only for authenticated requests
MAX_CONCURRENT_RUNS=2
MAX_DAILY_RUNS=25

# Optional — HF Hub push from DeployAgent
HUGGINGFACE_TOKEN=hf_...

# ── Authentication (Supabase) ────────────────────────────────────────────────
# Used to verify the caller's Supabase login token against /auth/v1/user.
# SUPABASE_URL + SUPABASE_ANON_KEY are required for token verification.
# SUPABASE_SERVICE_ROLE_KEY is used for run-ownership checks + sweep row writes.
SUPABASE_URL=https://your-project.supabase.co
SUPABASE_ANON_KEY=ey...
SUPABASE_SERVICE_ROLE_KEY=ey...

# Staged rollout switch. Leave false until the frontend (which now sends the
# Authorization: Bearer <token> header) is deployed, THEN set to true to start
# rejecting unauthenticated requests.
#   false → tokens verified when present, anonymous requests still allowed
#   true  → missing/invalid token → 401
REQUIRE_AUTH=false

# Optional — override upload/runs directories
# UPLOAD_DIR=uploads
# RUNS_DIR=../agents/runs