# proctoring.js — environment variables
#
# Nothing here is required. Every variable has a working fallback, and
# `npm test` plus all four verify:* suites run with none of them set.
#
# Copy this file and uncomment only what you need:
#
#   cp .env.example .env
#
# `.env` is gitignored and excluded from the npm tarball (see .gitignore and
# .npmignore). `.env.example` itself is committed — never put a real secret in it.
#
# Precedence: the real environment always wins over `.env`, under both `node` and
# `bun` (verified). A one-off override on the command line therefore still works
# even when this file sets the same variable:
#
#   DEMO_URL=https://example.com npm run verify:static
#
# The library reads NO environment variables. It is a browser package; its
# configuration (`backend.endpoint`, detector options) is passed to the `Proctor`
# constructor at runtime. Everything below is repo tooling only.

# ---------------------------------------------------------------------------
# Deploying the demo
# ---------------------------------------------------------------------------

# Netlify personal access token, used by `npm run deploy:demo`.
# Create one at https://app.netlify.com/user/applications#personal-access-tokens
#
# Fallback: the token `netlify login` saved to
# %APPDATA%/netlify/Config/config.json (Windows) or ~/.config/netlify/config.json.
# So if you have already run `netlify login` on this machine, you do not need
# this variable at all.
# NETLIFY_AUTH_TOKEN=

# ---------------------------------------------------------------------------
# Verifying the deployed demo
# ---------------------------------------------------------------------------

# Points `npm run verify:static` at the live site instead of the local folder.
#
# Deploying is not proof that the site works, so this is run against the live
# origin after every deploy:
#
#   DEMO_URL=https://proctoring-js-demo.netlify.app npm run verify:static
#
# Leave it unset to verify the local netlify-demo/ folder instead.
# DEMO_URL=https://proctoring-js-demo.netlify.app

# ---------------------------------------------------------------------------
# Tooling
# ---------------------------------------------------------------------------

# Browser executable for the four CDP suites (`verify:browser`, `verify:umd`,
# `verify:face`, `verify:static`). The driver is vendored at scripts/lib/cdp.mjs
# and speaks the DevTools Protocol to any Chromium-based browser.
#
# Usually you do NOT need this. The driver probes a built-in list and takes the
# first one that exists:
#
#   Windows  C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
#            C:\Program Files\Microsoft\Edge\Application\msedge.exe
#   Linux    /usr/bin/microsoft-edge, /usr/bin/google-chrome,
#            /usr/bin/chromium, /usr/bin/chromium-browser, /snap/bin/chromium
#   macOS    /Applications/{Microsoft Edge,Google Chrome}.app/Contents/MacOS/...
#
# Set it when your browser lives somewhere else — a portable install, a
# non-standard prefix, or a version manager:
#
#   EDGE_PATH=C:\Tools\msedge-portable\msedge.exe
#   EDGE_PATH=/opt/google/chrome/chrome
#
# A path that is set but wrong is an ERROR, not a silent fallback: the run stops
# and names the path. Otherwise a typo here would quietly test a different
# browser than the one you meant, and every check would still look green.
# EDGE_PATH=

# Interpreter for the throwaway static server that `verify:umd` and
# `verify:static` spawn. Defaults to `python` on PATH.
#
# Set it when the default is not usable — e.g. a Windows Store Python shim that
# opens the Store instead of running, or a machine with several versions:
# PYTHON=C:\Users\you\.workbuddy-ai\binaries\python\versions\3.13.12\python.exe

# Read by `node scripts/check-npm-auth.mjs`, the E403 diagnostic.
#
# `npm publish` itself does NOT read these two. npm uses the `_authToken` in
# ~/.npmrc unless that file references ${NODE_AUTH_TOKEN} explicitly, which is
# the usual CI setup. Set them here when you want the diagnostic script to test a
# token that is not the one in your .npmrc.
# NODE_AUTH_TOKEN=
# NPM_TOKEN=

# ---------------------------------------------------------------------------
# Read by the scripts, but not configured here
# ---------------------------------------------------------------------------

# The CDP driver puts each browser profile in the OS temp directory
# (`tmpProfile()` → `os.tmpdir()`), so there is nothing to set on any platform.
# It must stay outside this repo, or Vite will watch the profile's thousands of
# files and reload the page mid-check — which is exactly why the driver no
# longer builds this path from `%TEMP%`: that variable does not exist on Linux,
# where the path silently became a relative one and landed inside the repo.