# =========================================================================
# Selixes AI Gateway - Environment Configuration (.env.example)
# =========================================================================
# Copy this file to `.env` before running the stack:
# $ cp .env.example .env
# =========================================================================

# -------------------------------------------------------------------------
# 1. LLM Provider API Keys
# -------------------------------------------------------------------------
# Primary provider key (Required for upstream routing unless running local Ollama)
OPENAI_API_KEY=sk-proj_REPLACE_WITH_YOUR_OPENAI_KEY

# Standby provider key (Recommended for failover & stream splicing)
ANTHROPIC_API_KEY=sk-ant-api03_REPLACE_WITH_YOUR_ANTHROPIC_KEY

# Optional providers
GEMINI_API_KEY=REPLACE_WITH_YOUR_GEMINI_KEY
OLLAMA_BASE_URL=http://localhost:11434

# -------------------------------------------------------------------------
# 2. Local Infrastructure Defaults (Docker Compose & Local Dev)
# -------------------------------------------------------------------------
NODE_ENV=development
PORT=4000
API_URL=http://localhost:4000
APP_URL=http://localhost:3000
NEXT_PUBLIC_API_URL=http://localhost:4000

# PostgreSQL Configuration
POSTGRES_USER=selixes
POSTGRES_PASSWORD=selixes_dev_password
POSTGRES_DB=selixes_gateway
DATABASE_URL="postgresql://selixes:selixes_dev_password@postgres:5432/selixes_gateway?schema=public"

# Redis Configuration (Required for Idempotency, Quotas, and Redis Cache)
REDIS_HOST=redis
REDIS_PORT=6379
REDIS_PASSWORD=

# -------------------------------------------------------------------------
# 3. Gateway Reliability & Stream Splicing Configuration
# -------------------------------------------------------------------------
# Silence duration before initiating speculative standby stream (in milliseconds)
# Shipped default: 300ms
STREAM_STALL_MS=300

# Outage simulation mode (MUST be false in production; validated on boot)
GATEWAY_TEST_MODE=false

# Allowed test mode in production (Strictly for staging canary testing)
ALLOW_TEST_MODE_IN_PROD=false

# Time-Travel trajectory checkpoint TTL (in seconds; default: 3600s = 1 hour)
TIME_TRAVEL_TTL_SECONDS=3600

# -------------------------------------------------------------------------
# 4. Local ONNX Semantic Cache Settings
# -------------------------------------------------------------------------
# Enable semantic caching middleware (default: false)
SEMANTIC_CACHE_ENABLED=false

# Storage backend: "memory" (zero-dependency LRU), "redis", or "pinecone"
SEMANTIC_CACHE_BACKEND=memory
SEMANTIC_CACHE_CAPACITY=1000

# Embedding model: local ONNX MiniLM runs inside process with 0 cloud egress
SEMANTIC_CACHE_LOCAL_MODEL=Xenova/all-MiniLM-L6-v2

# Semantic cosine similarity threshold (Calibrated default: 0.95)
SEMANTIC_CACHE_THRESHOLD=0.95

# Opt-in Stage 2 Cross-Encoder reranker (requires ~400MB ONNX memory; default: false)
SEMANTIC_CACHE_CROSS_ENCODER=false

# Cache TTL (in seconds; default: 86400s = 24 hours)
SEMANTIC_CACHE_TTL_SECONDS=86400

# Bypass cache if prompt contains PII (default: true)
SEMANTIC_CACHE_SKIP_ON_PII=true

# Pinecone credentials (Only needed if SEMANTIC_CACHE_BACKEND=pinecone)
PINECONE_API_KEY=REPLACE_WITH_YOUR_PINECONE_KEY
PINECONE_INDEX=selixes-semantic-cache
PINECONE_HOST=

# -------------------------------------------------------------------------
# 5. Security, Encryption & Telemetry
# -------------------------------------------------------------------------
# 32-byte secret key used for AES-256 GCM encryption in the Replay Vault
# REQUIRED in production; the server will throw on startup if default or empty
REPLAY_CRYPTO_SECRET=REPLACE_WITH_SECURE_32_BYTE_SECRET_KEY_FOR_PROD

# Developer bypass token for local CLI testing (Optional)
DEV_BYPASS_TOKEN=selixes_local_dev_token

# Clerk Authentication (Required for Web Dashboard access)
NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=pk_test_REPLACE_WITH_YOUR_CLERK_KEY
CLERK_SECRET_KEY=sk_test_REPLACE_WITH_YOUR_CLERK_KEY
CLERK_WEBHOOK_SECRET=whsec_REPLACE_WITH_YOUR_WEBHOOK_SECRET