.env.example

# carry configuration. Copy to .env for local dev; set these as env vars on Render.

# Port the HTTP server binds to. Render sets PORT automatically; default 8080 locally.
PORT=8080

# The single source of auth. A JSON array of namespaces, each with a READ token
# (what your Claude mobile connector presents) and a WRITE token (what Claude Code
# / CI presents to push). The two MUST differ: a leaked read token can never
# overwrite your pack.
#
# Generate strong tokens, e.g. in PowerShell:
#   [Convert]::ToBase64String((1..32 | % { Get-Random -Max 256 }))
#
# Single-tenant example (just you):
CARRY_NAMESPACES=[{"namespace":"me","readToken":"REPLACE_READ","writeToken":"REPLACE_WRITE"}]

# Durable storage. Unset = in-memory (packs lost on restart; dev only).
# On Render, point at a file on the persistent disk:
#   CARRY_DB_URL=file:/data/carry.db
# For a hosted Turso DB, use a libsql:// URL plus an auth token:
#   CARRY_DB_URL=libsql://your-db.turso.io
#   CARRY_DB_AUTH_TOKEN=your-turso-token
# CARRY_DB_URL=file:./data/carry.db
# CARRY_DB_AUTH_TOKEN=

# --- Rate limiting (optional) -----------------------------------------------
# Fixed-window limit on POST /mcp, keyed by IP and token. Default 120/min.
# CARRY_RATE_LIMIT_PER_MIN=120

# --- OAuth 2.1 protected-resource mode (optional) ---------------------------
# Off unless CARRY_OAUTH_ISSUER is set. Enables the claude.ai web/mobile connector
# path (that dialog is OAuth-only on personal accounts). OAuth callers get READ
# scope only; pushing always uses the write token above.
#
# CARRY_OAUTH_ISSUER=https://your-tenant.authkit.app          # AuthKit domain (JWT iss)
# CARRY_OAUTH_AUDIENCE=https://your-instance.example.com/mcp  # your MCP URL / resource indicator (JWT aud)
# CARRY_OAUTH_NAMESPACE=me        # required only if you configure more than one namespace
# CARRY_OAUTH_JWKS_URL=           # optional; defaults to ${issuer}/oauth2/jwks
#
# Lock-to-user (STRONGLY recommended once OAuth is on): without these, ANY user who
# can authenticate to your tenant can read the pack. Restrict to yourself by sub
# and/or email (comma-separated; a caller passes if its sub OR email is listed).
# CARRY_OAUTH_ALLOWED_SUBS=user_yourid
# CARRY_OAUTH_ALLOWED_EMAILS=you@example.com