.env.example

# Copy to .env and fill in. Used by bot (npm run bot:local) and optionally by Expo.
# Do not commit .env.

# Telegram bot (required for local bot; optional for Expo app)
# Get token from @BotFather on Telegram
BOT_TOKEN=1234567890:ABCdefGHIjklMNOpqrsTUVwxyz-EXAMPLE
# Neon/Postgres connection string (from Neon dashboard)
DATABASE_URL=postgresql://user:password@ep-xxx-xxx.region.aws.neon.tech/neondb?sslmode=require
# OpenAI API key for /api/ai (required for AI responses). Get from https://platform.openai.com/api-keys
OPENAI=sk-proj-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

# Optional: TinyModel sidecar (classify + RAG) — hybrid with OpenAI for chat mode.
# Run from TinyModel repo: python scripts/phase3_reference_server.py --model HyperlinksSpace/TinyModel1 --port 8765
# TINYMODEL_API_URL=http://127.0.0.1:8765
# TINYMODEL_TIMEOUT_MS=8000
# AI_PROVIDER=hybrid

# Optional: base URL for calling APIs in dev (used by app and bot).
# Example for local Vercel dev: http://localhost:3000
# EXPO_PUBLIC_API_BASE_URL=http://localhost:3000

# Optional: Swap.Coffee API key for TON token info and routing.
# COFFEE=your-swap-coffee-api-key
# COFFEE_BASE_URL=https://api.swap.coffee
# COFFEE_TOKENS_BASE_URL=https://tokens.swap.coffee

# Google OAuth (Sign in with Google on welcome page). Web client from Google Cloud Console.
# GOOGLE_OAUTH_CLIENT_ID=....apps.googleusercontent.com
# GOOGLE_OAUTH_CLIENT_SECRET=...
# Optional override when API origin differs from redirect host:
# GOOGLE_OAUTH_REDIRECT_URI=https://hsbexpo.vercel.app/api/auth/google/callback

# GitHub OAuth (Sign in with GitHub on welcome page).
# Create an OAuth App: https://github.com/settings/developers
# Authorization callback URL must match redirect below (path is fixed in code).
# GITHUB_OAUTH_CLIENT_ID=Ov23li...
# GITHUB_OAUTH_CLIENT_SECRET=...
# Optional: force callback host when API public URL differs from request origin (Vercel/proxy).
# GITHUB_OAUTH_REDIRECT_URI=https://hsbexpo.vercel.app/api/auth/github/callback
#
# Sign in with Apple (Services ID + Sign in with Apple key from Apple Developer).
# APPLE_OAUTH_CLIENT_ID=com.example.app.web
# APPLE_OAUTH_TEAM_ID=ABCDE12345
# APPLE_OAUTH_KEY_ID=ABC123DEFG
# APPLE_OAUTH_PRIVATE_KEY="-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----"
# Optional:
# APPLE_OAUTH_REDIRECT_URI=https://hsbexpo.vercel.app/api/auth/apple/callback
#
# Also set EXPO_PUBLIC_API_BASE_URL to the same API origin the welcome page calls
# (e.g. https://hsbexpo.vercel.app) so /api/auth/github/start uses the matching redirect.

# Cloud KMS: full service-account JSON for /api/wallet/register (wraps DEK). See README § GCP_SERVICE_ACCOUNT_JSON.
# GCP_SERVICE_ACCOUNT_JSON={"type":"service_account",...}

# Ops-only: POST /api/wallet/envelope-verify proves Neon+KMS round-trip (never returns mnemonic). Set a long random secret.
# WALLET_ENVELOPE_VERIFY_SECRET=your-long-random-string

# Optional: log non-secret envelope persistence diagnostics from wallet-register.
# WALLET_ENVELOPE_DEBUG=1

# TDLib user-session gateway (real Telegram messages connect — QR login).
# Create an app at https://my.telegram.org/apps (api_id + api_hash). Server-only — never EXPO_PUBLIC_*.
# TELEGRAM_API_ID=12345678
# TELEGRAM_API_HASH=0123456789abcdef0123456789abcdef
# Local gateway (npm run tdlib:gateway): listens on 127.0.0.1:8787 by default.
# TDLIB_GATEWAY_PORT=8787
# TDLIB_GATEWAY_SECRET=change-me-long-random
# TDLIB_DB_ROOT=.tdlib-data
# Production: deploy gateway on Fly/Railway/GCP and point Vercel at it:
# TDLIB_GATEWAY_URL=https://your-tdlib-gateway.example.com
# GCP one-command deploy (after billing enabled): npm run gcp:tdlib-gateway
# GCP Console steps: deploy/gcp/CONSOLE.md
# No credit card: run gateway on your PC + tunnel — deploy/no-card/README.md