# Copy to .env (never committed). LocalNet needs nothing set. The values
# below are the defaults the scripts use when a variable is empty.

# localnet or devnet
DRAW_NETWORK=localnet

# ---------------------------------------------------------------- LocalNet
# Documented unsafe HS256 secret. Real networks must not use it.
LEDGER_AUTH_SECRET=unsafe
LEDGER_AUTH_AUDIENCE=https://canton.network.global
APP_PROVIDER_JSON_API=http://localhost:3975
APP_USER_JSON_API=http://localhost:2975
REGISTRY_URL=http://scan.localhost:4000/registry
SCAN_URL=http://scan.localhost:4000/api/scan

# ---------------------------------------------------------------- HackCanton DevNet (NODERS shared node)
# From the organizers' DevNet quickstart. One hackathon account is one ledger
# user that can act for every party it creates in the Console, so runs here are
# labelled single-credential. Create parties in the Console first:
# draw-admin, draw-lpa, draw-lpb, draw-lpc, draw-outsider.
#
# DRAW_NETWORK=devnet
# LEDGER_AUTH_MODE=password
# DRAW_JSON_API=https://ledger-api-json.participant.hackcanton-01.devnet.naas.noders.services
# OAUTH_TOKEN_URL=https://keycloak.naas.noders.services/realms/noders-appsfactory/protocol/openid-connect/token
# OAUTH_CLIENT_ID=web-app-ui-hackcanton-01-devnet
# HACKCANTON_USERNAME=
# HACKCANTON_PASSWORD=
# SCAN_PROXY_URL=https://validator-api-http.validator.hackcanton-01.devnet.naas.noders.services/api/validator/v0/scan-proxy
# REGISTRY_URL=https://validator-api-http.validator.hackcanton-01.devnet.naas.noders.services/api/validator/v0/scan-proxy/registry
# SCAN_AUTH_USER=shared
# DRAW_ADMIN_PARTY=
# DRAW_LPA_PARTY=
# DRAW_LPB_PARTY=
# DRAW_LPC_PARTY=
# DRAW_OUTSIDER_PARTY=
#
# Clients the node operator (NODERS) issued for DRAW. The backend client
# should act for the five demo parties and nothing else, and the verifier
# client should only read as the fund's party. scripts/demo/probe.mjs asks the
# node for each client's rights and records whether that holds. Probe
# 20261007T125624Z found both right. The earlier probe 20261006T133219Z found
# the verifier client also acting for the team's personal wallet party, a
# right NODERS removed on 2026-10-07. With the backend client the demo seats
# stop using a person's login, though the team login still has its own rights
# on the same five parties. Each user id is optional: unset, it is read from
# the client's token.
# For the backend client (with or without the verifier client):
# LEDGER_AUTH_MODE=oauth
# For the verifier client alone, keep LEDGER_AUTH_MODE=password above and set
# only the DRAW_VERIFIER_* lines.
# DRAW_BACKEND_CLIENT_ID=xidoncapitals-backend-hackcanton-01-devnet
# DRAW_BACKEND_CLIENT_SECRET=
# DRAW_BACKEND_USER=
# DRAW_BACKEND_SCOPE=
# DRAW_VERIFIER_CLIENT_ID=xidoncapitals-verifier-hackcanton-01-devnet
# DRAW_VERIFIER_CLIENT_SECRET=
# DRAW_VERIFIER_USER=
# DRAW_VERIFIER_SCOPE=
#
# Sign in with HackCanton, as on the live site, with DRAW's own public
# Keycloak client. The other DRAW_SIGN_IN_* values, in the next section,
# default from the settings in this block.
# DRAW_SIGN_IN=true
# DRAW_SIGN_IN_CLIENT_ID=xidoncapitals-web-app-hackcanton-01-devnet
# DRAW_SIGN_IN_WALLET_URL=https://wallet.validator.hackcanton-01.devnet.naas.noders.services

# ---------------------------------------------------------------- Sign in with HackCanton (DevNet)
# true lets an LP with its own HackCanton login join a demo fund as itself.
# Its browser signs in on the node's Keycloak (authorization code with PKCE),
# reads its notices and pays from its own Canton wallet with its own token.
# The API receives only its party id. Off by default, and always off with
# DRAW_PARTY_MODE=external. If a value below can't be worked out, sign-in stays
# off and the API logs which one.
# DRAW_SIGN_IN=false
# Keycloak realm URL. Unset, OAUTH_TOKEN_URL without /protocol/openid-connect/token
# DRAW_SIGN_IN_ISSUER=
# Public client the browser signs in with. Unset, OAUTH_CLIENT_ID
# DRAW_SIGN_IN_CLIENT_ID=
# DRAW_SIGN_IN_SCOPE=openid daml_ledger_api
# JSON Ledger API the browser reads and accepts on. Unset, the admin party's
# JSON Ledger API
# DRAW_SIGN_IN_LEDGER_API=
# The LP's wallet API (allocate, withdraw, tap, balance). Unset, the origin of
# SCAN_PROXY_URL plus /api/validator
# DRAW_SIGN_IN_VALIDATOR_API=
# Optional link to the node's Canton Coin wallet for the signed-in LP. Unset,
# no link
# DRAW_SIGN_IN_WALLET_URL=

# ---------------------------------------------------------------- DevNet with one OAuth client per role
# With DRAW_NETWORK=devnet the defaults switch to LEDGER_AUTH_MODE=oauth and
# DRAW_PARTY_MODE=provisioned. Fill these from what the organizers give you,
# and comment out the LocalNet block above.

# JSON Ledger API of the hosted participant
# DRAW_JSON_API=
# Only if the admin party is on a different participant. Any role can point at
# its own participant the same way, with DRAW_<ROLE>_JSON_API.
# DRAW_ADMIN_JSON_API=
# Scan and Token Standard registry, direct or through a validator scan proxy
# REGISTRY_URL=
# SCAN_URL=
# Ledger user whose token the scan proxy accepts, if it needs one
# SCAN_AUTH_USER=

# OAUTH_TOKEN_URL=
# OAUTH_AUDIENCE=
# OAUTH_SCOPE=daml_ledger_api

# One ledger user, party, and OAuth client per role. No shared credential.
# Each client can also take its own scope, DRAW_<ROLE>_SCOPE, which defaults
# to OAUTH_SCOPE.

# DRAW_ADMIN_USER=
# DRAW_ADMIN_PARTY=
# DRAW_ADMIN_CLIENT_ID=
# DRAW_ADMIN_CLIENT_SECRET=

# DRAW_LPA_USER=
# DRAW_LPA_PARTY=
# DRAW_LPA_CLIENT_ID=
# DRAW_LPA_CLIENT_SECRET=

# DRAW_LPB_USER=
# DRAW_LPB_PARTY=
# DRAW_LPB_CLIENT_ID=
# DRAW_LPB_CLIENT_SECRET=

# DRAW_LPC_USER=
# DRAW_LPC_PARTY=
# DRAW_LPC_CLIENT_ID=
# DRAW_LPC_CLIENT_SECRET=

# DRAW_OUTSIDER_USER=
# DRAW_OUTSIDER_PARTY=
# DRAW_OUTSIDER_CLIENT_ID=
# DRAW_OUTSIDER_CLIENT_SECRET=

# Verifier: readAs the admin party only, no actAs
# DRAW_VERIFIER_USER=
# DRAW_VERIFIER_CLIENT_ID=
# DRAW_VERIFIER_CLIENT_SECRET=
# DRAW_VERIFIER_SCOPE=

# User with participant_admin. It uploads the DAR, and with DRAW_PARTY_MODE
# allocate or external it also allocates the parties and creates their users.
# scripts/demo/provision.mjs needs it. Defaults to ledger-api-user on
# LocalNet, unset elsewhere.
# DRAW_OPERATOR_USER=
# DRAW_OPERATOR_CLIENT_ID=
# DRAW_OPERATOR_CLIENT_SECRET=

# ---------------------------------------------------------------- Parties
# Where the parties come from. allocate, the LocalNet default: the operator
# allocates fresh parties and users. provisioned, the default elsewhere: the
# party ids above. external: every party is an external party with its own
# key, held by the run or by each person's browser in the app.
# external-provisioned: external parties the node operator allocated from
# topology we signed, with their keys on this machine. Run 20261007T130259Z
# used it on the HackCanton node with LEDGER_AUTH_MODE=password: the team's
# login submits what each party's key signed. Leave DRAW_VERIFIER_* unset
# there, since the verifier client reads only as the regular fund party.
# DRAW_PARTY_MODE=allocate

# For external-provisioned: the operator's list of the allocated parties, and
# the prefix of the local key names (the prefix plus the role).
# DRAW_EXTERNAL_PARTIES_FILE=internal/noders-external-parties/summary.json
# DRAW_EXTERNAL_KEY_PREFIX=devnet-ext-

# A party to name as verifier on new funds (draw 0.3.0). It observes the fund,
# its calls and its obligations, and the read-back step reads through it.
# Unset, funds name no verifier and the read-back reads as the fund's party.
# DRAW_VERIFIER_PARTY=

# ---------------------------------------------------------------- Scripted run and campaign
# Seconds from issuing the scripted call to its due time
# DRAW_DUE_SECONDS=90
# Units one faucet tap adds. The run taps once per LP. The app taps for
# "Add test CC", and when a demo fund starts it tops up an LP that is short.
# 0 skips the run's taps and the app's top-up, for LPs that hold coin already.
# DRAW_TAP_AMOUNT=100.0
# true lets a refusal that comes back with only a trace id count as a refusal,
# recorded with reasonHidden. Defaults to false on LocalNet, true elsewhere.
# DRAW_ERRORS_HIDDEN=false
# Seed and size of the generated campaign (scripts/eval/campaign.mjs)
# DRAW_EVAL_SEED=20261002
# DRAW_EVAL_CASES=100
# Unset, the scripts and the app load this file. Set to none in the shell,
# never here, to skip it, so a process sees only the environment it was
# started with. Tests use it.
# DRAW_ENV_FILE=

# ---------------------------------------------------------------- The app's API (app/server.mjs)
# Port the API listens on
# PORT=4173
# Actions need this code. Reading never does. Unset, actions need no code.
# DRAW_ACCESS_CODE=
# true hands the code to the site, which prints it and fills it in
# DRAW_ACCESS_CODE_PUBLIC=false
# When set, the API answers only requests that carry this token. The web
# worker holds the same value as a secret and adds it in its proxy.
# DRAW_SERVICE_TOKEN=
# Folder for the session file and the per-browser demo fund file. Unset, the
# app/ folder.
# DRAW_STATE_DIR=
# Folder where the app writes and serves evidence. Unset, evidence/
# DRAW_EVIDENCE_DIR=
# Rate limits, written as actions/seconds, or off. Each limit counts per
# visitor address, and its _GLOBAL twin counts everyone together. Starting a
# demo fund, issuing a call and tapping the faucet also count as actions.
# DRAW_ACTION_LIMIT=30/600
# DRAW_ACTION_LIMIT_GLOBAL=120/600
# DRAW_SETUP_LIMIT=3/3600
# DRAW_SETUP_LIMIT_GLOBAL=20/3600
# DRAW_ISSUE_LIMIT=10/3600
# DRAW_ISSUE_LIMIT_GLOBAL=40/3600
# DRAW_FAUCET_LIMIT=5/3600
# DRAW_FAUCET_LIMIT_GLOBAL=30/3600
# The most records any ledger list the app reads may hold. The API refuses an
# action that would pass it, with "The demo is full right now".
# DRAW_LIST_CEILING=600
# Browsers with their own demo fund that the API remembers. The least recently
# used are forgotten first.
# DRAW_TOUR_CAP=300
# Settle exact matching payments automatically, through the same path as the
# Settle button. Off by default, and always off with DRAW_PARTY_MODE=external.
# DRAW_AUTO_SETTLE=false
# How often automatic settlement looks for matching payments, in milliseconds
# DRAW_AUTO_SETTLE_MS=5000

# ---------------------------------------------------------------- The web app (web/)
# Where the web app's proxy sends /api and /evidence requests. No default: set
# it in web/.env.local for development (http://localhost:4173), and in
# web/wrangler.jsonc for the worker. The worker's DRAW_SERVICE_TOKEN comes from
# this file, stored as a worker secret by `npm run cf:deploy`.
# DRAW_API_URL=

# ---------------------------------------------------------------- Health watchdog (deploy/draw-health.sh)
# draw-health.service reads these from the app's .env, with PORT and
# DRAW_SERVICE_TOKEN. The URL defaults to /api/health on 127.0.0.1 at PORT.
# DRAW_HEALTH_URL=http://127.0.0.1:4173/api/health
# Seconds between restarts, at least
# DRAW_HEALTH_COOLDOWN_SECONDS=600