# ─────────────────────────────────────────────────────────────────────────────
# Steward — Environment Variables
# Copy this file to .env and fill in the values.
#
#   cp .env.example .env
#
# Required variables are marked [REQUIRED]. Everything else has a default.
# ─────────────────────────────────────────────────────────────────────────────

# ─── API Server ───────────────────────────────────────────────────────────────

# Port the API listens on.
PORT=3200

# Host the API binds to. Use 0.0.0.0 to accept external connections (behind
# a reverse proxy). Default is 127.0.0.1 (loopback only).
STEWARD_BIND_HOST=127.0.0.1

# Steward API version string (informational, set by the codebase).
# API_VERSION=0.3.0

# ─── Security — Master Password ──────────────────────────────────────────────

# [REQUIRED] Master password used for:
#   - Deriving per-agent vault encryption keys (AES-256-GCM via PBKDF2)
#   - Fallback JWT signing secret if STEWARD_JWT_SECRET is not set
# Use a long, random string. Rotating this requires re-encrypting all keys.
STEWARD_MASTER_PASSWORD=

# JWT signing secret for agent-scoped tokens (auth.ts, context.ts, proxy).
# Defaults to STEWARD_MASTER_PASSWORD if not set.
# Set explicitly for independent key rotation.
STEWARD_JWT_SECRET=

# JWT signing secret for user/dashboard sessions (user.ts).
# Defaults to STEWARD_MASTER_PASSWORD if not set.
# NOTE: Both STEWARD_JWT_SECRET and STEWARD_SESSION_SECRET should be set
# in production. They serve different token audiences (agents vs users).
STEWARD_SESSION_SECRET=

# Expiry for agent-scoped JWT tokens (e.g. "1h", "24h", "7d").
AGENT_TOKEN_EXPIRY=24h

# ─── Database ─────────────────────────────────────────────────────────────────

# [REQUIRED for full/Postgres mode] PostgreSQL connection string.
# Example: postgres://steward:password@localhost:5432/steward
DATABASE_URL=

# Database mode. Set to "pglite" to use the embedded PGLite backend instead
# of an external PostgreSQL server. Useful for local dev and desktop mode.
# When not set, DATABASE_URL is used.
# STEWARD_DB_MODE=pglite

# ─── PGLite (embedded / local mode) ──────────────────────────────────────────
# These only apply when STEWARD_DB_MODE=pglite or DATABASE_URL is unset.

# Directory where PGLite persists data. Default: ~/.steward/data
# STEWARD_PGLITE_PATH=~/.steward/data

# Set to "true" for in-memory PGLite (no persistence, useful for testing).
# STEWARD_PGLITE_MEMORY=false

# ─── Tenant & Platform Auth ───────────────────────────────────────────────────

# Default tenant API key (plaintext). Used when no X-Steward-Tenant header
# is present. Useful for single-tenant self-hosted deployments.
STEWARD_DEFAULT_TENANT_KEY=

# Platform operator keys (comma-separated). These keys authenticate requests
# to the /platform/* routes, which have cross-tenant admin access.
# Generate with: openssl rand -hex 32
STEWARD_PLATFORM_KEYS=

# ─── EVM / Blockchain ─────────────────────────────────────────────────────────

# Default RPC URL for EVM transactions and balance queries.
RPC_URL=https://sepolia.base.org

# Default chain ID (used when no chain is specified in a signing request).
# 84532 = Base Sepolia (testnet), 8453 = Base (mainnet)
CHAIN_ID=84532

# ─── Auth — Email (Magic Links) ───────────────────────────────────────────────

# Resend API key for sending magic link emails.
# If not set, magic link tokens are printed to the console (dev mode).
# Get one at https://resend.com
RESEND_API_KEY=

# From address for magic link emails.
EMAIL_FROM=login@steward.fi

# Base URL for magic link callbacks. Must be publicly accessible.
# The link in the email will be: APP_URL/auth/callback/email?token=...&email=...
APP_URL=https://steward.fi

# ─── Auth — Passkeys (WebAuthn) ───────────────────────────────────────────────

# Relying Party name shown to users during passkey registration.
PASSKEY_RP_NAME=Steward

# Relying Party ID — must match the domain where the app is served.
PASSKEY_RP_ID=steward.fi

# Allowed origin for passkey operations. Must match the browser's origin.
PASSKEY_ORIGIN=https://steward.fi

# ─── Auth — OAuth (Google, Discord, GitHub) ───────────────────────────────────

# Google OAuth (for "Continue with Google" login).
# Create credentials at https://console.cloud.google.com/apis/credentials
GOOGLE_CLIENT_ID=
GOOGLE_CLIENT_SECRET=

# Discord OAuth (for "Continue with Discord" login).
# Create app at https://discord.com/developers/applications
DISCORD_CLIENT_ID=
DISCORD_CLIENT_SECRET=

# GitHub OAuth (for "Continue with GitHub" login).
# Create app at https://github.com/settings/developers
GITHUB_CLIENT_ID=
GITHUB_CLIENT_SECRET=

# Optional comma-separated allowlist for SIWE/SIWS message domains.
# Example: SIWE_ALLOWED_DOMAINS=app.steward.fi,steward.fi
SIWE_ALLOWED_DOMAINS=

# ─── Redis (optional) ─────────────────────────────────────────────────────────

# Redis connection URL. Required for:
#   - Rate limiting enforcement (per-IP request counts)
#   - Proxy spend tracking (LLM token usage per tenant)
#   - Tenant policy caching
# If not set, rate limiting falls back to in-memory and spend tracking is disabled.
# Example: redis://localhost:6379
REDIS_URL=

# ─── Proxy ─────────────────────────────────────────────────────────────────────

# Port the proxy gateway listens on (default: 8080).
STEWARD_PROXY_PORT=8080

# ─── Migrations ───────────────────────────────────────────────────────────────

# Set to "true" to skip automatic migrations on API startup.
# Useful when running migrations separately via scripts/migrate.sh.
# SKIP_MIGRATIONS=false

# ─── Auth — OAuth (Twitter / X) ───────────────────────────────────────────────

# Twitter/X OAuth (for "Continue with Twitter" login).
# Create app at https://developer.x.com/en/portal/dashboard
TWITTER_CLIENT_ID=
TWITTER_CLIENT_SECRET=

# ─── Web Dashboard (web/ — Next.js) ───────────────────────────────────────────
# These variables are used by the Next.js web app, not the API server.
# Prefix NEXT_PUBLIC_ variables are exposed to the browser bundle.

# URL of your Steward API instance.
NEXT_PUBLIC_STEWARD_API_URL=http://localhost:3200

# WalletConnect project ID for RainbowKit (SIWE wallet login).
# Get one at https://cloud.walletconnect.com
NEXT_PUBLIC_WC_PROJECT_ID=

# URL of the Steward Proxy service (for credential injection).
STEWARD_PROXY_URL=http://localhost:3201

# API key for the Steward agent (used by the web app's server-side API routes).
STEWARD_AGENT_TOKEN=