env.example

SLLR_PORT=3100
SLLR_PUBLIC_ORIGIN=http://localhost:3100

# Buyer auth: orders/receipts bind to a buyerId when the caller presents a buyer
# session token (POST /buyer/session -> 'Authorization: Bearer <token>' on /mcp
# and order endpoints). Anonymous ordering is allowed by default. Set this to
# require a valid buyer token for every order (production "must be signed in").
# SLLR_REQUIRE_BUYER_AUTH=true

# Durable order + demo-merchant state. Without these, SLL-R keeps state in
# memory: fine for local dev, a single long-running process, and demo
# recordings, but on serverless (Vercel) each invocation is a fresh instance,
# so orders and demo merchants are lost between requests. Configure ONE backend
# for real pilots. GET /health reports the active backend ("memory",
# "redis_rest", or "supabase"). Selection order: Supabase -> Redis/KV -> memory.
#
# Option A — Supabase Postgres (PostgREST, zero SDK dep). Create the two tables
# first: see docs/supabase-store-runbook.md. Use the service-role key.
# SUPABASE_URL=https://your-project-ref.supabase.co
# SUPABASE_SERVICE_ROLE_KEY=replace-with-service-role-secret-key
#
# Option B — Vercel KV / Upstash Redis REST. Vercel KV env names:
# KV_REST_API_URL=https://your-kv-endpoint.upstash.io
# KV_REST_API_TOKEN=replace-with-kv-rest-token
# Or Upstash env names:
# UPSTASH_REDIS_REST_URL=https://your-endpoint.upstash.io
# UPSTASH_REDIS_REST_TOKEN=replace-with-upstash-rest-token

# Merchant verifier secret. Gates payment proof (POST /merchants/:id/payment)
# AND receipt issuance (the fulfill/claim staff actions, POST /merchants/:id/
# receipt, and the issue_receipt MCP tool). REQUIRED for any real pilot: without
# it, anyone who can reach the API can mint receipt memory with no proof. When
# set, the staff terminal pages read it from localStorage (sllrStaffSecret) and
# send the x-sllr-merchant-payment-secret header; API callers send that header
# or a verificationToken field. demo=true is only accepted when no secret is set.
# SLLR_MERCHANT_PAYMENT_VERIFY_SECRET=replace-with-random-server-secret

# Optional gate for demo merchant ingestion (POST /demo-merchants and the
# create_demo_merchant MCP tool). Without this secret, ingestion is open;
# set it on any public deployment.
# SLLR_DEMO_MERCHANT_SECRET=replace-with-random-server-secret

# Stripe prepay-in-flow (non-crypto pay-at-order: card / Apple / Google Pay).
# When set, the `stripe` rail returns a hosted Checkout URL; the buyer pays in
# the agent flow and the merchant only fulfills. The signed POST /webhooks/stripe
# (checkout.session.completed) attaches payment proof. Without the webhook
# secret, the webhook accepts demo=true for local testing. v0 is no-fee on a
# single platform account; Stripe Connect + application_fee (take-rate) is the
# next step. STRIPE_API_BASE is a test-only override (leave unset in prod).
# STRIPE_SECRET_KEY=sk_live_or_test_xxx
# STRIPE_WEBHOOK_SECRET=whsec_xxx

# LINE Pay prepay-in-flow (Taiwan). When set, the `line_pay` rail reserves a
# payment and returns a LINE Pay payment URL; the buyer authorizes in LINE and
# is redirected to /line-pay/confirm, which captures the payment and issues
# receipt memory. Same "merchant only fulfills" model as Stripe. Currency
# defaults to TWD (whole units). LINE_PAY_API_BASE is the sandbox/test override
# (sandbox: https://sandbox-api-pay.line.me).
# LINE_PAY_CHANNEL_ID=your-line-pay-channel-id
# LINE_PAY_CHANNEL_SECRET=your-line-pay-channel-secret
# LINE_PAY_CURRENCY=TWD
# LINE_PAY_API_BASE=https://sandbox-api-pay.line.me

# Optional Base MCP demo recipient. Must be a wallet you control or are willing
# to receive demo USDC payments with. Do not use a burn/random address.
# SLLR_BASE_COFFEE_RECIPIENT=0x0000000000000000000000000000000000000000

# Optional Solana Pay / Helio demo rail. Use a Solana wallet you control for
# live demos. Without verifier secrets, proof endpoints require demo=true.
# SLLR_SOLANA_PAY_RECIPIENT=11111111111111111111111111111111
# SLLR_SOLANA_PAY_SPL_TOKEN=So11111111111111111111111111111111111111112
# SLLR_SOLANA_PAY_VERIFY_SECRET=replace-with-random-server-secret
# SLLR_HELIO_CHECKOUT_BASE_URL=https://app.hel.io/pay/replace-with-paylink
# SLLR_HELIO_WEBHOOK_SECRET=replace-with-helio-webhook-secret

# Optional Shopify adapter config. Storefront MCP can be discovered from the
# domain, while Storefront API cart creation and webhooks require merchant setup.
# SLLR_SHOPIFY_NOUN_COFFEE_DOMAIN=noun.coffee
# SLLR_SHOPIFY_RAPOSA_SHOP_DOMAIN=raposacoffee.com
# SLLR_SHOPIFY_SOLYD_DOMAIN=solyd.store
# SLLR_SHOPIFY_NOUN_COFFEE_STOREFRONT_TOKEN=replace-with-storefront-token
# SLLR_SHOPIFY_RAPOSA_SHOP_STOREFRONT_TOKEN=replace-with-storefront-token
# SLLR_SHOPIFY_SOLYD_STOREFRONT_TOKEN=replace-with-storefront-token
# SLLR_SHOPIFY_WEBHOOK_SECRET=replace-with-shopify-app-client-secret

# Optional: when configured, SLL-R can call a real receipt memory endpoint after
# payment or fulfillment proof. The scaffold keeps this as a no-secret stub by
# default.
# SLLR_RECEIPT_API_URL=https://sll-r.example/api/merchant/receipts
# SLLR_RECEIPT_API_KEY=replace-with-server-side-token