# Copy to `.env` locally (cp env.sample .env). Never commit `.env` — it is gitignored.

# DEEPSEEK_API_KEY: Required for DeepSeek V3/R1 optimization patches.
DEEPSEEK_API_KEY=
# APP_URL: The URL where this applet is hosted.
# AI Studio automatically injects this at runtime with the Cloud Run service URL.
# Used for self-referential links, OAuth callbacks, and API endpoints.
APP_URL="MY_APP_URL"

# API_KEYS: Comma-separated list of valid API keys for the OmniPulse AI SDK.
# Example: TCG-PRO-key1,TCG-PRO-key2
API_KEYS=""

# API_KEY_TENANT_CONFIG: JSON map from API key to tenant profile.
# Example:
# {"TCG-PRO-key1":{"tenantId":"tenant_prod","name":"Production","dailyQuotaUsd":5,"alertThresholdRatio":0.8,"role":"admin"}}
API_KEY_TENANT_CONFIG=""

# PROMOTION_GATE_POLICY: JSON policy for governed promote thresholds.
# Example: {"minPrecision":0.6,"maxFalsePositiveRate":0.4,"minRealizedSavingsRate":0.05}
PROMOTION_GATE_POLICY=""

# Runtime state backend selector: file | postgres
RUNTIME_STATE_BACKEND="file"
SESSION_TTL_SECONDS="86400"
SESSION_RENEW_WINDOW_SECONDS="1800"
# In production, prefer true to require HTTPS-only cookies.
SESSION_COOKIE_SECURE="false"
# Checkout session anti-abuse guardrails
CHECKOUT_RATE_LIMIT_WINDOW_SECONDS="300"
CHECKOUT_RATE_LIMIT_MAX_PER_WINDOW="5"
# Free signup anti-abuse guardrails (per source IP)
FREE_SIGNUP_RATE_LIMIT_WINDOW_SECONDS="3600"
FREE_SIGNUP_RATE_LIMIT_MAX_PER_WINDOW="3"

# Used when RUNTIME_STATE_BACKEND=postgres
DATABASE_URL=""

# Optional alert webhook delivery configuration
ALERT_WEBHOOK_URL=""
ALERT_WEBHOOK_RETRIES="2"
ALERT_WEBHOOK_TIMEOUT_MS="1500"
# Enable online decision pre-gate in /api/v1/optimize (recommend/custom decision).
# false: keep legacy optimize mode behavior; true: apply decision.action.reasoning_mode when provided.
COST_AWARE_DECISION_ENABLED="false"
# v1: structural prompt / cache layout API (POST /api/v1/optimize/messages)
TCG_OPTIMIZE_MESSAGES_ENABLED="true"
# Comma-separated tenant IDs treated as Pro for optimize/messages (staging override)
TCG_PRO_TENANT_IDS=""
# Per API key in API_KEY_TENANT_CONFIG: "planTier": "audit" | "pro" | "enterprise"

# --- Stripe (test mode) — server-side only; never commit real values ---
# Dashboard: https://dashboard.stripe.com/test/apikeys — toggle “Test mode”, copy Secret key (sk_test_…).
STRIPE_SECRET_KEY=
# Only if you add Stripe.js / Checkout in the browser (publishable key, pk_test_…).
STRIPE_PUBLISHABLE_KEY=
# Webhook signing secret (whsec_…) from `stripe listen` or Dashboard → Webhooks → endpoint signing secret.
# After deploy, endpoint URL (example staging):
#   https://token-cost-guard-staging-1025499628522.us-central1.run.app/api/v1/billing/stripe/webhook
STRIPE_WEBHOOK_SECRET=
# Monthly overage cap for pay-as-you-go guardrail (USD). <=0 disables cap.
BILLING_OVERAGE_CAP_USD="5"
# Readiness thresholds for dashboard /api/v1/dashboard/billing-recovery.
BILLING_RECOVERY_MIN_STARTED_SAMPLES="5"
BILLING_RECOVERY_GO_MIN_SUCCESS_RATE_PCT="40"
BILLING_RECOVERY_NO_GO_CRITICAL_SUCCESS_RATE_PCT="25"
# Free tier default daily quota in USD.
FREE_PLAN_DAILY_QUOTA_USD="1"
# Pro plan pricing strategy: $9 early bird in launch month, then $15 standard.
PRO_PLAN_EARLY_BIRD_PRICE_USD="9"
PRO_PLAN_STANDARD_PRICE_USD="15"
PRO_PLAN_EARLY_BIRD_START_AT="2026-04-25T00:00:00.000Z"
PRO_PLAN_EARLY_BIRD_END_AT="2026-05-31T00:00:00.000Z"
# Stripe recurring prices for plan A (grandfathering by price ID).
STRIPE_PRICE_PRO_EARLY_BIRD_MONTHLY=""
STRIPE_PRICE_PRO_STANDARD_MONTHLY=""
# true: existing subscribers keep original price ID; false: follow active catalog pricing.
PRO_PLAN_GRANDFATHERING_ENABLED="true"

# Referral provider webhook signing secret for /api/v1/referral/webhook (HMAC-SHA256 hex).
REFERRAL_WEBHOOK_SECRET=
# Alert threshold for referral risk score (0-100).
REFERRAL_RISK_ALERT_THRESHOLD="60"
# Referral risk model weights (used in /api/v1/referral/risk-summary and risk alerts).
REFERRAL_RISK_WEIGHT_IGNORED_RATE="0.4"
REFERRAL_RISK_WEIGHT_SELF_REFERRAL="15"
REFERRAL_RISK_WEIGHT_DUPLICATE_REFEREE="10"
REFERRAL_RISK_WEIGHT_REWARD_REVERSED="8"
# Risk trend query supports: days (default 30) or from/to (ISO), with granularity day|week.