docs: add missing env vars documentation (verifier config)

.env.example

@@ -54,6 +54,10 @@ VERIFIER_REDIS_TIMEOUT_MS=2000
 
 # Service URLs (for Docker/production)
 VERIFIER_URL=http://127.0.0.1:3002
+
+# Maximum allowed request body size in bytes for verifier
+# Default: 1048576 (1MB)
+MAX_REQUEST_BODY_BYTES=1048576
 # Comma-separated frontend origins allowed by the gateway CORS middleware.
 # Use origins only, with no path/query/fragment.
 # Defaults to http://localhost:3001 when unset or blank.
@@ -113,8 +117,12 @@ CACHE_ENABLED=false
 CACHE_TTL_SECONDS=3600
 
 # Frontend (Next.js / web/) — all read at build time, prefixed NEXT_PUBLIC_
+# Verifier warm-up endpoint used by frontend banner
+# Default: unset (set this to let the banner warm the verifier too)
+# NEXT_PUBLIC_VERIFIER_URL=https://<verifier-app>.onrender.com
 # Gateway URL the browser hits for /api/ai/summarize and /api/receipts/:id
 # NEXT_PUBLIC_GATEWAY_URL=http://localhost:3000
+
 # Chain ID the wallet widget expects (must match the gateway CHAIN_ID).
 # Default 84532 (Base Sepolia).
 # NEXT_PUBLIC_EXPECTED_CHAIN_ID=84532

README.md

@@ -242,7 +242,6 @@ Edit `.env` before starting the gateway. At minimum:
 - `SERVER_WALLET_PRIVATE_KEY`: required for signing receipts. Use an unfunded development key locally.
 - `RECIPIENT_ADDRESS`: recipient address embedded in payment contexts.
 - `CHAIN_ID` and `EXPECTED_CHAIN_ID`: must match. The default is `84532` for Base Sepolia.
-
 The root `bun run stack` command starts the gateway with `RECEIPT_STORE=memory` and `CACHE_ENABLED=false` unless you exported different values in the shell. That means the normal quick start does not require Redis even though production-style receipt storage defaults to Redis.
 
 ### Run The Stack
@@ -332,6 +331,8 @@ Core local variables live in [.env.example](.env.example). Production placeholde
 | `RECEIPT_STORE` | Gateway | `redis` by default, `memory` for tests/local experiments. |
 | `REDIS_URL` | Gateway/Verifier | Required when `RECEIPT_STORE=redis`, `CACHE_ENABLED=true`, or `VERIFIER_NONCE_STORE=redis`. |
 | `VERIFIER_URL` | Gateway | **Required.** Where the gateway calls `/verify` (e.g. `http://127.0.0.1:3002` for `bun run stack`, `https://<app>.onrender.com` for Render). The gateway refuses to start if unset — no silent loopback fallback. |
+| `NEXT_PUBLIC_VERIFIER_URL` | Web | Frontend verifier warm-up endpoint used by banner for pre-warming the verifier. |
+| `MAX_REQUEST_BODY_BYTES` | Verifier | Maximum request body size in bytes for verifier. Must be a positive integer; values less than or equal to 0 or invalid values fall back to the default `1048576` (1MB). |
 | `CACHE_ENABLED` | Gateway | Optional response cache. Payment verification still runs on cache hits. |
 | `METRICS_ENABLED` | Gateway | Enables the Prometheus metrics endpoint by default. Set to `false` to disable. |
 | `METRICS_PATH` | Gateway | Gateway metrics path. Default `/metrics`; values without a leading slash are normalized. |

docker-compose.yml

@@ -46,6 +46,7 @@ services:
       - EXPECTED_CHAIN_ID=${EXPECTED_CHAIN_ID:-${CHAIN_ID:-84532}}
       - SIGNATURE_EXPIRY_SECONDS=${SIGNATURE_EXPIRY_SECONDS:-300}
       - SIGNATURE_CLOCK_SKEW_SECONDS=${SIGNATURE_CLOCK_SKEW_SECONDS:-60}
+      - MAX_REQUEST_BODY_BYTES=${MAX_REQUEST_BODY_BYTES:-1048576}
       - VERIFIER_NONCE_STORE=${VERIFIER_NONCE_STORE:-redis}
       - VERIFIER_NONCE_KEY_PREFIX=${VERIFIER_NONCE_KEY_PREFIX:-microai:verifier:nonce:}
       - VERIFIER_REDIS_TIMEOUT_MS=${VERIFIER_REDIS_TIMEOUT_MS:-2000}
@@ -100,6 +101,7 @@ services:
         # mainnet chain id and the wallet widget + stat bar will contradict
         # each other.
         NEXT_PUBLIC_GATEWAY_URL: ${NEXT_PUBLIC_GATEWAY_URL:-http://localhost:3000}
+        NEXT_PUBLIC_VERIFIER_URL: ${NEXT_PUBLIC_VERIFIER_URL:-}
         NEXT_PUBLIC_EXPECTED_CHAIN_ID: ${NEXT_PUBLIC_EXPECTED_CHAIN_ID:-${CHAIN_ID:-84532}}
         NEXT_PUBLIC_EXPECTED_CHAIN_NAME: ${NEXT_PUBLIC_EXPECTED_CHAIN_NAME:-Base Sepolia}
         NEXT_PUBLIC_PAYMENT_AMOUNT: ${NEXT_PUBLIC_PAYMENT_AMOUNT:-${PAYMENT_AMOUNT:-0.001}}

web/Dockerfile

@@ -10,6 +10,7 @@ WORKDIR /app
 # in docker-compose / CI; otherwise the container ships the source defaults
 # regardless of the gateway's CHAIN_ID / PAYMENT_AMOUNT config.
 ARG NEXT_PUBLIC_GATEWAY_URL=http://localhost:3000
+ARG NEXT_PUBLIC_VERIFIER_URL=
 ARG NEXT_PUBLIC_EXPECTED_CHAIN_ID=84532
 ARG NEXT_PUBLIC_EXPECTED_CHAIN_NAME="Base Sepolia"
 ARG NEXT_PUBLIC_PAYMENT_AMOUNT=0.001
@@ -18,6 +19,7 @@ ARG NEXT_PUBLIC_POSTHOG_ENABLED=false
 ARG NEXT_PUBLIC_POSTHOG_PROJECT_TOKEN=
 ARG NEXT_PUBLIC_POSTHOG_HOST=https://us.i.posthog.com
 ENV NEXT_PUBLIC_GATEWAY_URL=$NEXT_PUBLIC_GATEWAY_URL
+ENV NEXT_PUBLIC_VERIFIER_URL=$NEXT_PUBLIC_VERIFIER_URL
 ENV NEXT_PUBLIC_EXPECTED_CHAIN_ID=$NEXT_PUBLIC_EXPECTED_CHAIN_ID
 ENV NEXT_PUBLIC_EXPECTED_CHAIN_NAME=$NEXT_PUBLIC_EXPECTED_CHAIN_NAME
 ENV NEXT_PUBLIC_PAYMENT_AMOUNT=$NEXT_PUBLIC_PAYMENT_AMOUNT

web/README.md

@@ -20,6 +20,7 @@ The frontend reads these `NEXT_PUBLIC_*` environment variables at build time:
 | Variable | Default | Notes |
 | --- | --- | --- |
 | `NEXT_PUBLIC_GATEWAY_URL` | `http://localhost:3000` | Gateway base URL the browser fetches `/api/ai/summarize` and `/api/receipts/:id` from. |
+| `NEXT_PUBLIC_VERIFIER_URL` | unset | Optional verifier endpoint used by the frontend warm-up banner to pre-warm the verifier and improve first-request UX. |
 | `NEXT_PUBLIC_EXPECTED_CHAIN_ID` | `84532` | Chain id the wallet widget expects. Must match the gateway's `CHAIN_ID`. Deployments on Base mainnet should set `8453` so the widget doesn't fight every payment context. |
 | `NEXT_PUBLIC_EXPECTED_CHAIN_NAME` | `Base Sepolia` | Display name used by the wallet widget's `Switch to <name>` button and the summarize form's placeholder copy. |
 | `NEXT_PUBLIC_PAYMENT_AMOUNT` | `0.001` | Pre-challenge fee label shown under the summarize form. **Informational only** — the actual signed amount is whatever the gateway embeds in the 402 payment context. |