# ---------------------------------------------------------------------------
# AI Software Factory — environment configuration
# Copy to .env and fill in real values. NEVER commit secrets to source control.
# ---------------------------------------------------------------------------

# App
NODE_ENV=************ (redacted)
PORT=************ (redacted)
WEB_URL=************ (redacted)
API_URL=************ (redacted)
REALTIME_URL=************ (redacted)
PUBLIC_BASE_URL=************ (redacted)

# Database (PostgreSQL)

# Redis (caching, queues, presence)

# Auth / Sessions
JWT_EXPIRES_IN=************ (redacted)
REFRESH_TOKEN_TTL_DAYS=************ (redacted)
BCRYPT_ROUNDS=************ (redacted)

# S3-compatible object storage (MinIO in local dev) — TASK-0101 (two private
# buckets; `S3_BUCKET` is the legacy alias for S3_BUCKET_FILES).
S3_BUCKET_FILES=************ (redacted)
S3_BUCKET_THUMBS=************ (redacted)
S3_BUCKET=************ (redacted)
S3_REGION=************ (redacted)
S3_FORCE_PATH_STYLE=************ (redacted)
S3_SIGN_EXPIRY_SECONDS=************ (redacted)
# ClamAV (dev mode = empty; Docker profile sets CLAMAV_HOST=clamav:3310)
CLAMD_SOCKET=************ (redacted)
CLAMAV_HOST=************ (redacted)
CLAMAV_PORT=************ (redacted)

# Search (OpenSearch)
SEARCH_USERNAME=************ (redacted)
SEARCH_PASSWORD=************ (redacted)
SEARCH_INDEX_PREFIX=************ (redacted)
# Content-index dense_vector tuning (TASK-0099 — dimensions are immutable per
# index; a change rolls a new index via `pnpm search:reindex`). HNSW: m /
# ef_construction, dimension = the embedding model's output (1536 =
# text-embedding-3-small).
SEARCH_VECTOR_DIMENSION=************ (redacted)
SEARCH_KNN_M=************ (redacted)
SEARCH_KNN_EF_CONSTRUCTION=************ (redacted)

# AI gateway (provider-agnostic; any OpenAI-compatible endpoint works)
AI_PROVIDER=************ (redacted)
AI_BASE_URL=************ (redacted)
AI_API_KEY=************ (redacted)
AI_MODEL=************ (redacted)
AI_EMBEDDING_MODEL=************ (redacted)
# Embedding provider for the `embed:chunks` job (TASK-0099). EMPTY (default)
# = no real provider wired: the job logs "embedding disabled (Phase 12)" and
# skips (the chunk docs' vector stays null). Set to a provider name to record
# placeholder AiEmbedding cache rows until Phase 12 wires the real call.
AI_EMBEDDING_PROVIDER=************ (redacted)

# Email (SMTP)
SMTP_HOST=************ (redacted)
SMTP_PORT=************ (redacted)
SMTP_USER=************ (redacted)
SMTP_PASSWORD=************ (redacted)
SMTP_FROM=************ (redacted)

# Realtime
REALTIME_PORT=************ (redacted)
REALTIME_HEARTBEAT_MS=************ (redacted)
YJS_STORAGE_PREFIX=************ (redacted)
# Shared service token for the internal endpoints (`/internal/*`, TASK-0092
# slice 2): the realtime gateway authenticates to the api's internal block
# endpoints (hydration read + the flush's CAS persist) with this bearer
# token. Empty (default) = the internal endpoints are CLOSED (fail-closed).

# Webhooks
WEBHOOK_RETRY_MAX=************ (redacted)
WEBHOOK_TIMEOUT_MS=************ (redacted)

# Rate limiting
# NOTE: the realtime app reads RATE_LIMIT_WINDOW_MS / RATE_LIMIT_MAX. The API
# guard (apps/api/src/common/guards/rate-limit.guard.ts) reads a DIFFERENT pair
# — RATE_LIMIT_API / RATE_LIMIT_AUTH (per user/min) — so the two lines above
# do NOT affect the API. The API guard's defaults (100/min, 10/min) throttle
# the local full-stack E2E (which legitimately makes many calls), so they are
# raised high here for local dev/E2E only (this .env is gitignored; CI sets its
# own). Recorded in the Phase 11 gap report as a pre-existing env-naming split.
RATE_LIMIT_WINDOW_MS=************ (redacted)
RATE_LIMIT_MAX=************ (redacted)
RATE_LIMIT_API=************ (redacted)
RATE_LIMIT_AUTH=************ (redacted)

# Observability (optional; enable in Phase 15)
OTEL_ENABLED=************ (redacted)
OTEL_EXPORTER_OTLP_ENDPOINT=************ (redacted)

# Encryption (application-level secret encryption, at-rest secrets)
DATABASE_URL=************ (redacted)
REDIS_URL=************ (redacted)
SEARCH_URL=************ (redacted)
S3_ENDPOINT=************ (redacted)
S3_ACCESS_KEY=************ (redacted)
S3_SECRET_KEY=************ (redacted)
JWT_SECRET=************ (redacted)
REFRESH_TOKEN_SECRET=************ (redacted)
SESSION_SECRET=************ (redacted)
MASTER_ENCRYPTION_KEY=************ (redacted)
INTERNAL_SERVICE_TOKEN=************ (redacted)
INTERNAL_TEST_SEAM=************ (redacted)