# Local-only Cloudflare Worker bindings. Copy to .dev.vars and replace each value.
# Secrets must never be committed.
# AUTH_KV, FOLDER_CACHE, and MPU are configured bindings in wrangler.jsonc, not .dev.vars values.

# S3 Signature V4 credentials held by CLI clients or your BFF.
ACCESS_KEY=replace-with-access-key-id
SECRET_KEY=replace-with-long-random-secret
REGION=auto

# Google OAuth credentials with Drive API access.
GOOGLE_CLIENT_ID=replace-with-google-oauth-client-id
GOOGLE_CLIENT_SECRET=replace-with-google-oauth-client-secret
GOOGLE_REFRESH_TOKEN=replace-with-google-refresh-token

# Comma-separated, exact bucket names. Unset denies every bucket.
ALLOWED_BUCKETS=assets
# Optional comma-separated subset of ALLOWED_BUCKETS that permits unsigned GET/HEAD.
PUBLIC_READ_BUCKETS=

# Durable Object multipart uploads and ETag result behavior.
ALLOW_MULTIPART=true
ETAG_STYLE=md5

# Browser CORS: comma-separated exact origins or *. Leave empty to disable CORS.
CORS_ALLOWED_ORIGINS=http://localhost:5173
# Set false to disable /docs and /openapi.yaml.
ENABLE_DOCS=true