# Add your OpenAI API key to run the sample workflows in Mastra Studio.
OPENAI_API_KEY=

# Local defaults. Leave these settings unchanged for your first run.
MASTRA_STORAGE_URL=file:./incident.db
MASTRA_MODEL=openai/gpt-4o-mini
RUNTIME_MODE=local
WEBHOOKS_ENABLED=false
WORKOS_PROVIDER_ENABLED=false
IPINFO_PROVIDER_ENABLED=false
LINEAR_PROVIDER_ENABLED=false
DEVICE_TRUST_PROVIDER_ENABLED=false
DASHBOARD_AUTH_ENABLED=false

# Optional local settings.
# PORT=3000
# RUNBOOK_FASTEMBED_CACHE_DIR=.cache/fastembed

# External integrations: see docs/provider-setup.md before enabling a provider.
# Use staging or production for real identity evidence and containment.
# RUNTIME_MODE=staging
# APPROVAL_RESUME_SECRET=
# MASTRA_STORAGE_AUTH_TOKEN=

# Signed alert intake. Requires WEBHOOKS_ENABLED=true and a random secret.
# ALERT_WEBHOOK_SECRET=
# ALERT_WEBHOOK_SOURCES=reference-auth,first-party-device-trust

# WorkOS identity evidence and approved containment.
# Requires signed intake and WORKOS_PROVIDER_ENABLED=true.
# WORKOS_API_KEY=
# WORKOS_WEBHOOK_SECRET=
# WORKOS_ORGANIZATION_ID=
# WORKOS_ALLOWED_ROLE_SLUGS=member,admin
# Optional: restrict users within the configured organization.
# WORKOS_ALLOWED_USER_IDS=

# First-party device attestation. Requires signed intake and its provider flag.
# DEVICE_TRUST_ALERT_SOURCE=first-party-device-trust

# Authenticated dashboard. Requires DASHBOARD_AUTH_ENABLED=true.
# WORKOS_CLIENT_ID=
# WORKOS_REDIRECT_URI=http://localhost:3000/auth/callback
# WORKOS_COOKIE_PASSWORD=
# DASHBOARD_ORIGIN=http://localhost:3000
# DASHBOARD_CSRF_SECRET=

# Optional IPinfo enrichment. Requires IPINFO_PROVIDER_ENABLED=true.
# IPINFO_TOKEN=
# IPINFO_TIMEOUT_MS=1500
# GEOIP_CACHE_HMAC_KEY=
# GEOIP_CACHE_HMAC_KEY_VERSION=hmac-sha256-v1

# Optional Linear destination. Requires LINEAR_PROVIDER_ENABLED=true.
# LINEAR_API_KEY=
# LINEAR_WORKSPACE_ID=
# LINEAR_TEAM_ID=
# LINEAR_INTERNAL_BASE_URL=https://your-host/dashboard
# LINEAR_PROJECT_ID=
# Optional maps; omit to discover existing team states and severity labels.
# LINEAR_SEVERITY_LABEL_NAMES_JSON={"high":"High"}
# LINEAR_STATUS_STATE_NAMES_JSON={"awaiting_approval":"In Review","contained":"Done","closed":"Done"}

# Optional signed local HTTP approval; not needed for Studio's Resume input.
# LOCAL_APPROVALS_ENABLED=true
# LOCAL_APPROVAL_SECRET=

# Secret requirements, ID-based Linear maps and rotation: docs/configuration.md.
# demo:local and eval:check deliberately do not load .env.