# ── Server ────────────────────────────────────────────
HOST=0.0.0.0
PORT=8000
LOG_LEVEL=info

# ── Database (SQLite by default; Postgres opt-in) ─────
# DATABASE_URL=postgresql+asyncpg://user:pass@host:5432/orca

# ── Redis (optional — improves throughput) ────────────
# REDIS_URL=redis://localhost:6379/0

# ── Encryption (auto-generated on first run if empty) ──
# Once generated, set these explicitly so DB-stored provider
# keys remain decryptable across restarts.
# CREDENTIAL_ENCRYPTION_KEY=    # 64 hex chars (32 bytes)
# API_KEY_PEPPER=               # 32+ char string

# ── Provider keys (BYOK) ──────────────────────────────
# Set the provider keys you want to route through. Either
# put them here, or add them via the web UI (encrypted at rest).
# Env vars are convenient for ephemeral environments; UI-set
# keys take precedence when both are configured.

# OPENAI_API_KEY=sk-...
# ANTHROPIC_API_KEY=sk-ant-...
# GOOGLE_API_KEY=
# GROQ_API_KEY=gsk_...
# TOGETHER_API_KEY=
# FIREWORKS_API_KEY=

# ── Hosted-as-upstream (managed safety net) ───────────
# When set, OrcaRouter Lite uses your hosted orcarouter.ai
# account as one more provider. Useful for: try-before-you-buy,
# falling back when local providers fail, or running zero-config
# with everything routed through hosted.
# ORCAROUTER_API_KEY=sk-orca-...
# ORCAROUTER_BASE_URL=https://api.orcarouter.ai/v1

# ── Quality scoring (Artificial Analysis) ────────────
# When set, `model="auto"` with strategy="quality" picks the model
# with the highest Intelligence Index from artificialanalysis.ai's
# benchmark aggregator instead of "the most expensive". Required
# because newer flagships (Opus 4.7, etc.) are now priced LOWER
# than older ones, so cost-as-quality-proxy picks the wrong model.
#
# Sign up free at https://artificialanalysis.ai (free tier: 1000
# req/day, far more than needed since we cache for 1h). Without a
# key, quality strategy degrades to the legacy cost-based behavior.
# Attribution is shown in the dashboard when scoring is active.
# ARTIFICIAL_ANALYSIS_API_KEY=

# ── Router behavior (cooldown + cascade) ──────────────
# How long a deployment is skipped after a failure (404 / 408 / 429 / 401).
# Default 60s is dev-friendly — a bad key recovers in a minute, no need to
# restart the process. Production under sustained traffic should bump this
# to 600-3600 to avoid burning quota on a known-dead model. Tests set 0.
# ROUTER_COOLDOWN_SECONDS=60
# ROUTER_ALLOWED_FAILS=0
# ROUTER_PRE_CALL_CHECKS=true
# In-deployment retry counts. The "auto" path uses 0 so cascade to the
# next fallback model happens immediately on failure (avoids 30-90s of
# perceived latency from retrying a dead deployment 2x first).
# ROUTER_NUM_RETRIES_DEFAULT=2
# ROUTER_NUM_RETRIES_AUTO=0