.env.example

# ─── Anthropic (required) ──────────────────────────────────────────────────
# The four Mastra agents run on Claude Haiku via Mastra's built-in model router
# (model id "anthropic/claude-haiku-4-5"). The router reads this key from the
# environment — no provider SDK to wire up by hand.
# Get one at https://console.anthropic.com/settings/keys
#
# ⚠️ The deployed demo is PUBLIC and the "Run pipeline" button calls the model.
#    Set a SPEND CAP on this key (Anthropic console → Limits). A full 4-agent
#    run is a handful of short Haiku calls, but a public endpoint deserves a cap.
ANTHROPIC_API_KEY=

# ─── Database (required) ───────────────────────────────────────────────────
# Supabase Postgres connection string. The app only ever READS the seeded data
# (invoices / purchase_orders / goods_receipts) — see the README on why running
# the pipeline never writes. Use the connection POOLER string from Supabase
# (Project → Settings → Database → Connection pooling, "Transaction" mode) so
# serverless functions don't exhaust direct connections:
#   postgresql://postgres.<ref>:<password>@<region>.pooler.supabase.com:6543/postgres
DATABASE_URL=

# ─── Migrations / seeding (optional) ───────────────────────────────────────
# `pnpm db:push` and `pnpm db:seed` need a DIRECT (non-pooled) connection. If
# this is set, those scripts use it; otherwise they fall back to DATABASE_URL.
# Direct string (port 5432):
#   postgresql://postgres.<ref>:<password>@<region>.pooler.supabase.com:5432/postgres
DIRECT_DATABASE_URL=

# ─── Redis (optional — per-IP rate limiting) ───────────────────────────────
# If a URL + token are set, /api/run rate-limits each IP (8 runs / 10 min) so a
# public visitor can't drain the Anthropic budget. If they're missing, rate
# limiting FAILS OPEN (a warning is logged) and the app still runs locally.
#
# "Redis on Vercel" is Upstash via the Marketplace (Vercel's first-party KV was
# deprecated). The code accepts EITHER naming — nothing to rename:
#   • Provisioned at https://console.upstash.com/redis  → use the UPSTASH_ vars
#   • Provisioned via the Vercel dashboard (Storage tab) → Vercel auto-injects
#     KV_REST_API_URL / KV_REST_API_TOKEN; nothing to set by hand.
UPSTASH_REDIS_REST_URL=
UPSTASH_REDIS_REST_TOKEN=
# Vercel Marketplace naming also works as a fallback:
# KV_REST_API_URL=
# KV_REST_API_TOKEN=

# ─── QuickBooks Online (optional — pull the client's open POs from their ERP) ─
# The pipeline reads a client's existing purchase orders from QuickBooks and
# matches incoming invoices against them (the procurement mirror of reading the
# org from BambooHR). If all four are set, lib/erp.ts pulls LIVE from the QBO
# sandbox; if any is missing, it replays the recorded fixture
# (db/fixtures/quickbooks/purchase-orders.json) — so CI and a fresh checkout run
# with no key. Read-only; the run never writes back.
#
# Create a free app at https://developer.intuit.com (QuickBooks Online), then use
# the OAuth 2.0 Playground (scope com.intuit.quickbooks.accounting) to get a
# refresh token + realm id. Then:
#   pnpm erp:seed      push the scenario's POs into the sandbox (mirror of hris:seed)
#   pnpm erp:capture   record what comes back into the recorded fixture
#   pnpm erp:reset     remove the seeded POs again
# Note: QBO rotates the refresh token on refresh — the scripts write the rotated
# value back here automatically so the next run keeps working.
QBO_CLIENT_ID=
QBO_CLIENT_SECRET=
QBO_REFRESH_TOKEN=
QBO_REALM_ID=
# Optional: a directly-minted access token (good ~1h). If set, the scripts use it
# as-is and skip the refresh exchange — handy for a one-off capture from the
# Playground without touching the refresh token.
# QBO_ACCESS_TOKEN=

# ─── Nightly reset cron (optional) ─────────────────────────────────────────
# Every run is persisted as an append-only audit row (agent_runs); a daily Vercel
# Cron (vercel.json) hits /api/reset to truncate + reseed Postgres so the demo
# returns to a pristine queue each morning. The route is guarded by this shared
# secret — Vercel injects it as `Authorization: Bearer $CRON_SECRET`; anything else
# gets 401. Unset → the route refuses all callers (nothing resets). Postgres only;
# the reset never touches the QuickBooks/BambooHR sandboxes.
CRON_SECRET=