.env.example

# Stellar Configuration
STELLAR_NETWORK=testnet
STELLAR_ISSUER_SECRET=

# SEP-02 Federation Server
# The domain served in federation addresses, e.g. "alice*mobilemoney.com"
STELLAR_FEDERATION_DOMAIN=mobilemoney.com
# Full base URL of this service (used in stellar.toml FEDERATION_SERVER line)
STELLAR_FEDERATION_SERVER_URL=https://api.mobilemoney.com

# Other Configuration
PORT=3000
NODE_ENV=development
DATABASE_URL=
REDIS_URL=
RATE_LIMIT_WINDOW_MS=900000
RATE_LIMIT_MAX_REQUESTS=100
REQUEST_SIZE_LIMIT=10mb

# ---------------------------------------------------------------------------
# Response Compression
# ---------------------------------------------------------------------------
# Enable/disable response compression (default: true)
COMPRESSION_ENABLED=true
# Compression threshold in bytes - only compress responses larger than this (default: 1024)
COMPRESSION_THRESHOLD=1024
# Compression level 1-9, where 1 is fastest and 9 is best compression (default: 6)
COMPRESSION_LEVEL=6

# ---------------------------------------------------------------------------
# CORS
# Cache preflight responses to reduce repeated browser OPTIONS requests.
# Value is in seconds. Default: 86400 (24 hours)
# ---------------------------------------------------------------------------
CORS_MAX_AGE=86400

# ---------------------------------------------------------------------------
# Authentication
# ---------------------------------------------------------------------------
ADMIN_API_KEY=dev-admin-key

# ---------------------------------------------------------------------------
# Geolocation (ip-api.com — leave blank for free tier, set for pro tier)
# ---------------------------------------------------------------------------
GEOLOCATION_API_KEY=
# Override the base URL if using a different provider (e.g. MaxMind)
GEOLOCATION_API_BASE=http://ip-api.com/json
# Comma-separated IP prefixes/patterns treated as trusted reverse proxies
# (in addition to RFC-1918 ranges which are always trusted)
# Example: TRUSTED_PROXY_CIDRS=10.100.0.*,172.20.0.*
TRUSTED_PROXY_CIDRS=
JWT_SECRET=replace-with-a-secure-shared-secret
OAUTH_CLIENT_ID=mobile-money-client
OAUTH_CLIENT_SECRET=replace-with-a-secure-client-secret
OAUTH_REDIRECT_URI=http://localhost:3000/oauth/callback
OAUTH_ISSUER=mobile-money-api
OAUTH_AUDIENCE=mobile-money-api
OAUTH_JWT_SECRET=replace-with-a-dedicated-oauth-jwt-secret
OAUTH_DEFAULT_SCOPE=transactions:read reports:read
OAUTH_ACCESS_TOKEN_TTL_SECONDS=3600
OAUTH_REFRESH_TOKEN_TTL_SECONDS=2592000
OAUTH_AUTH_CODE_TTL_SECONDS=300

# ---------------------------------------------------------------------------
# OIDC SSO Configuration (Google & Azure AD) -> Issue #521
# ---------------------------------------------------------------------------
# Google OAuth2
SSO_GOOGLE_CLIENT_ID=
SSO_GOOGLE_CLIENT_SECRET=
SSO_GOOGLE_CALLBACK_URL=http://localhost:3000/api/auth/sso/oidc/google/callback

# Azure AD (OpenID Connect)
SSO_AZURE_OIDC_CLIENT_ID=
SSO_AZURE_OIDC_CLIENT_SECRET=
SSO_AZURE_OIDC_ISSUER=https://login.microsoftonline.com/YOUR_TENANT_ID
SSO_AZURE_OIDC_CALLBACK_URL=http://localhost:3000/api/auth/sso/oidc/azure/callback

# ---------------------------------------------------------------------------
# Redis (for distributed locks)
# ---------------------------------------------------------------------------
REDIS_URL=redis://localhost:6379

# ---------------------------------------------------------------------------
# Brute Force / Account Lockout
# ---------------------------------------------------------------------------
# Maximum failed login attempts before the account is temporarily locked.
MAX_LOGIN_ATTEMPTS=5
# Sliding window (in minutes) during which failed attempts are counted.
LOCKOUT_WINDOW_MINUTES=10
# Duration (in minutes) the account remains locked after the threshold is hit.
LOCKOUT_DURATION_MINUTES=30
# Optional: SendGrid template ID for the lockout notification email.
# If omitted, an inline HTML fallback is used.
SENDGRID_LOCKOUT_TEMPLATE_ID=
# ---------------------------------------------------------------------------
# Stellar Network
# ---------------------------------------------------------------------------
STELLAR_NETWORK=testnet
STELLAR_HORIZON_URL=https://horizon-testnet.stellar.org
STELLAR_ISSUER_SECRET=YOUR_STELLAR_SECRET_KEY
STELLAR_RECEIVING_ACCOUNT=GABC... # Anchor's receiving account for SEP-31
STELLAR_ASSET_CODE=USDC
STELLAR_ASSET_ISSUER=G...
STELLAR_WEBHOOK_SECRET=your_stellar_webhook_secret

# SEP-10 Authentication (Web Auth)
# Server signing key for SEP-10 challenge transactions (secret key)
STELLAR_SIGNING_KEY=
# Domain used in manageData operation key and JWT issuer
STELLAR_WEB_AUTH_DOMAIN=https://api.mobilemoney.com
# Home domain for multi-domain SEP-10 setups
STELLAR_HOME_DOMAIN=mobilemoney.com
# Challenge transaction validity in seconds (default: 900 = 15 min)
SEP10_CHALLENGE_EXPIRY=900
# JWT token expiration for SEP-10 (default: 1h)
SEP10_JWT_EXPIRES_IN=1h

# ---------------------------------------------------------------------------
# stellar.toml (SEP-01) — Dynamic TOML Generation
# ---------------------------------------------------------------------------
# Domain used to build server URLs in stellar.toml (no protocol, no trailing slash)
STELLAR_FEDERATION_DOMAIN=mobilemoney.com
# Base URL of this service (overrides domain-derived defaults for all SEP servers)
STELLAR_FEDERATION_SERVER_URL=https://api.mobilemoney.com
# Explicit override for the FEDERATION_SERVER line (optional)
# STELLAR_FEDERATION_SERVER=https://api.mobilemoney.com/federation
# Explicit override for the AUTH_SERVER line (optional — SEP-10)
# STELLAR_AUTH_SERVER=https://api.mobilemoney.com/auth
# Explicit override for the KYC server (optional — SEP-12)
# SEP12_KYC_SERVER=https://api.mobilemoney.com/sep12
# Explicit override for the SEP-24 transfer server (optional)
# SEP24_TRANSFER_SERVER=https://api.mobilemoney.com/sep24
# Explicit override for the SEP-31 direct payment server (optional)
# SEP31_SERVER=https://api.mobilemoney.com/sep31
# Human-readable description appended to the primary asset CURRENCIES entry
STELLAR_ASSET_DESC=USDC stablecoin — anchored 1:1 to USD
# Number of decimal places shown by wallets (default: 7)
STELLAR_ASSET_DECIMALS=7
# Whether the asset is anchored to an off-chain asset (default: true)
STELLAR_ASSET_ANCHORED=true
# Off-chain asset type: fiat | crypto | stock | bond | commodity | realestate | other
STELLAR_ASSET_ANCHOR_TYPE=fiat
# Underlying off-chain asset ticker (default: derived from STELLAR_ASSET_CODE)
STELLAR_ASSET_ANCHOR_ASSET=USD
# Additional currencies as a JSON array of AssetEntry objects (optional)
# STELLAR_EXTRA_ASSETS=[{"code":"EURC","issuer":"G...","status":"live","desc":"Euro Coin"}]
# Organisation info for [DOCUMENTATION] section
ORG_NAME=Mobile Money Anchor
ORG_DBA=
ORG_URL=https://mobilemoney.com
ORG_LOGO=https://mobilemoney.com/logo.png
ORG_DESCRIPTION=Mobile money to Stellar asset anchor
ORG_SUPPORT_EMAIL=support@mobilemoney.com

# ---------------------------------------------------------------------------
# Stellar Channel Accounts Pool (Issue #192)
# ---------------------------------------------------------------------------
# Channel accounts enable high-throughput concurrent transaction submission
# by using multiple accounts to avoid sequence number bottlenecks.
#
# Format: JSON array of channel account credentials
# Example: [{"publicKey":"G...","secretKey":"S..."},{"publicKey":"G...","secretKey":"S..."}]
STELLAR_CHANNEL_ACCOUNTS=

# Pool Configuration
# Maximum time (ms) an account can be locked before auto-release (default: 30000)
CHANNEL_POOL_LOCK_TIMEOUT_MS=30000
# Maximum consecutive errors before disabling an account (default: 5)
CHANNEL_POOL_MAX_ERRORS=5
# Time (ms) to wait before re-enabling a disabled account (default: 60000)
CHANNEL_POOL_RECOVERY_MS=60000
# Maximum queue size for waiting requests (default: 100)
CHANNEL_POOL_MAX_QUEUE=100
# Time (ms) to wait in queue before timing out (default: 10000)
CHANNEL_POOL_QUEUE_TIMEOUT_MS=10000

# ---------------------------------------------------------------------------
# Mobile Money Providers
# ---------------------------------------------------------------------------
MTN_API_KEY=your_mtn_api_key
MTN_API_SECRET=your_mtn_api_secret
MTN_SUBSCRIPTION_KEY=your_mtn_subscription_key
MTN_BASE_URL=https://sandbox.momodeveloper.mtn.com
MTN_TARGET_ENVIRONMENT=sandbox

AIRTEL_API_KEY=your_airtel_api_key
AIRTEL_API_SECRET=your_airtel_api_secret
AIRTEL_BASE_URL=https://openapi.airtel.africa
AIRTEL_COUNTRY=NG
AIRTEL_CURRENCY=NGN

# Local provider mock server for offline development.
# In Docker development, set MTN_BASE_URL=http://provider-mock:4010/mtn
# and AIRTEL_BASE_URL=http://provider-mock:4010/airtel.
PROVIDER_MOCK_PORT=4010
PROVIDER_MOCK_DELAY_MS=0
PROVIDER_MOCK_BALANCE=100000
PROVIDER_MOCK_CURRENCY=XAF

ORANGE_API_KEY=your_orange_api_key
ORANGE_API_SECRET=your_orange_api_secret

# Orange Money web-session integration.
# Use these when Orange does not expose a direct REST API and a merchant web
# portal session must be maintained by the backend.
ORANGE_MODE=web
ORANGE_WEB_BASE_URL=https://orange-money.example
ORANGE_USERNAME=your_orange_portal_username
ORANGE_PASSWORD=your_orange_portal_password
ORANGE_LOGIN_PATH=/login
ORANGE_REFRESH_PATH=/session/refresh
ORANGE_PAYMENT_PATH=/transactions/collections
ORANGE_PAYOUT_PATH=/transactions/payouts
ORANGE_STATUS_PATH=/transactions/:reference
ORANGE_SESSION_STORE_PATH=.orange-session/session.json
ORANGE_SESSION_TTL_MS=1200000
ORANGE_REFRESH_SKEW_MS=60000
ORANGE_MAX_ATTEMPTS=3
ORANGE_CURRENCY=XAF

# Optional direct REST API mode. Set ORANGE_MODE=direct when Orange provides
# OAuth client_credentials endpoints instead of a merchant web portal.
ORANGE_BASE_URL=https://sandbox.orange.com
ORANGE_DIRECT_AUTH_PATH=/oauth/token
ORANGE_DIRECT_PAYMENT_PATH=/v1/payments/collect
ORANGE_DIRECT_PAYOUT_PATH=/v1/payments/disburse
ORANGE_DIRECT_STATUS_PATH=/v1/payments/:reference

# Optional scraping-free bridge/proxy. When configured, Orange operations are
# sent to this proxy instead of using the web-login session adapter directly.
ORANGE_PROXY_URL=
ORANGE_PROXY_SECRET=

# Failover configuration
# Enable automatic provider failover (true/false)
PROVIDER_FAILOVER_ENABLED=false
# Configure backups using PROVIDER_BACKUP_<PRIMARY> variables. Example:
# PROVIDER_BACKUP_MTN=airtel
# PROVIDER_BACKUP_ORANGE=airtel

# Chaos Testing (Staging/Test only)
ENABLE_PROVIDER_CHAOS=false
CHAOS_LATENCY_CHANCE=0.1
CHAOS_LATENCY_MS=5000
CHAOS_500_CHANCE=0.05
CHAOS_DROP_CHANCE=0.02

# ---------------------------------------------------------------------------
# Provider-Specific Transaction Limits (in XAF)
# ---------------------------------------------------------------------------
# MTN limits (default: 100 - 500,000)
MTN_MIN_AMOUNT=100
MTN_MAX_AMOUNT=500000

# Airtel limits (default: 100 - 1,000,000)
AIRTEL_MIN_AMOUNT=100
AIRTEL_MAX_AMOUNT=1000000

# Orange limits (default: 500 - 750,000)
ORANGE_MIN_AMOUNT=500
ORANGE_MAX_AMOUNT=750000

# ---------------------------------------------------------------------------
# Currency / Exchange Rates (exchangerate-api.com)
# Free tier: https://www.exchangerate-api.com/
# If unset the service falls back to static approximate rates.
# ---------------------------------------------------------------------------
EXCHANGE_RATE_API_KEY=your_exchange_rate_api_key

# ---------------------------------------------------------------------------
# Historical Price Ticker (USD/XLM/XAF)
# Runs hourly, stores snapshots in the historical_prices table, and powers
# the /api/v1/prices/* endpoints (including 'value at time of transaction').
# ---------------------------------------------------------------------------
# Cron expression for the hourly snapshot job. Default: top of every hour.
PRICE_TICKER_CRON=0 * * * *
# Optional CoinGecko API base (free public API uses /api/v3).
COINGECKO_API_BASE=https://api.coingecko.com/api/v3
# Optional CoinGecko demo/pro API key. Sent as x-cg-demo-api-key when set.
COINGECKO_API_KEY=
# Base URL for exchangerate-api.com (used for USD/XAF since XAF is not a
# CoinGecko vs_currency).
EXCHANGERATE_API_BASE=https://v6.exchangerate-api.com/v6
# HTTP timeout (ms) for price-provider API calls.
PRICE_TICKER_TIMEOUT_MS=10000

# ---------------------------------------------------------------------------
# Request Timeout
# ---------------------------------------------------------------------------
REQUEST_TIMEOUT_MS=30000

# KYC Transaction Limits (in XAF - Central African Franc)
# These limits enforce daily transaction caps based on user verification levels
# Unverified: Basic account with no identity verification
LIMIT_UNVERIFIED=10000
# Basic: Account with basic identity verification (ID card, phone number)
LIMIT_BASIC=100000
# Full: Account with complete KYC verification (ID, proof of address, selfie)
LIMIT_FULL=1000000

# Per-Transaction Amount Limits (in XAF)
# These limits prevent individual transactions that are too small or too large
# Minimum transaction amount (prevents micro-transactions and spam)
MIN_TRANSACTION_AMOUNT=100
# Maximum transaction amount (fraud prevention for single large transactions)
MAX_TRANSACTION_AMOUNT=1000000

# ---------------------------------------------------------------------------
# AML Monitoring (Anti-Money Laundering)
# ---------------------------------------------------------------------------
# Flag single transactions greater than this threshold
AML_SINGLE_TRANSACTION_THRESHOLD_XAF=1000000
# Flag users whose rolling 24h total exceeds this threshold
AML_DAILY_TOTAL_THRESHOLD_XAF=5000000
# Rolling lookback window used for aggregate checks
AML_ROLLING_WINDOW_HOURS=24
# Rapid in/out transaction detection window
AML_RAPID_WINDOW_MINUTES=15
# Minimum rapid transaction count to trigger structuring alerts
AML_RAPID_TRANSACTION_COUNT=3
# Minimum value to consider a transaction as possible structuring
AML_STRUCTURING_FLOOR_XAF=100000
# GraphQL (/graphql) — optional in development; required in production (NODE_ENV=production)
GRAPHQL_API_KEY=
# Optional label for the authenticated principal (returned by the `me` query)
GRAPHQL_CLIENT_SUBJECT=api-client

# Scheduled Jobs
# Cron expressions (defaults shown)
CLEANUP_CRON=0 2 * * *
REPORT_CRON=0 6 * * *
STATUS_CHECK_CRON=0 * * * *
ACCOUNT_MERGE_CRON=0 3 * * *

# Cleanup: retain completed/failed transactions for this many days (default: 90)
LOG_RETENTION_DAYS=90

# Status check: minutes before a pending transaction is considered stuck (default: 60)
STUCK_TRANSACTION_MINUTES=60

# Account merge: merge inactive auxiliary Stellar accounts to reclaim base reserves
# Comma-separated Stellar secret keys for merge source accounts
STELLAR_AUXILIARY_ACCOUNT_SECRETS=
# Destination account for merged balances. If unset, the issuer account is used.
STELLAR_ACCOUNT_MERGE_DESTINATION=
# Number of inactive days required before an auxiliary account is eligible
ACCOUNT_MERGE_INACTIVITY_DAYS=30
# Set to true to log merge candidates without submitting transactions
ACCOUNT_MERGE_DRY_RUN=false

# --- Email Configuration (Nodemailer) ---
SMTP_HOST=smtp.ethereal.email
SMTP_PORT=587
SMTP_USER=your_smtp_user
SMTP_PASS=your_smtp_password
EMAIL_FROM="Mobile Money" <no-reply@mobilemoney.com>

# ---------------------------------------------------------------------------
# AWS S3 Configuration (for KYC document uploads)
# ---------------------------------------------------------------------------
AWS_REGION=us-east-1
AWS_ACCESS_KEY_ID=your_aws_access_key_id
AWS_SECRET_ACCESS_KEY=your_aws_secret_access_key
AWS_S3_BUCKET=mobile-money-kyc-documents

# KYC Provider Configuration
KYC_API_URL=https://api.entrust.com
KYC_API_KEY=your_kyc_api_key
KYC_WEBHOOK_SECRET=your_webhook_secret

# --- Twilio Configuration ---
TWILIO_ACCOUNT_SID=your_twilio_account_sid
TWILIO_AUTH_TOKEN=your_twilio_auth_token
TWILIO_PHONE_NUMBER=your_twilio_sms_number
SMS_PROVIDER=twilio # 'twilio' or 'none'

# WhatsApp Official API (Twilio)
WHATSAPP_ENABLED=false
TWILIO_WHATSAPP_NUMBER=whatsapp:+14155238886
TWILIO_WHATSAPP_TRANSACTION_TEMPLATE_SID=HX...
TWILIO_WHATSAPP_OTP_TEMPLATE_SID=HX...
USE_HTTP2=false  # Set to true with valid certs to enable HTTP/2

# ---------------------------------------------------------------------------
# Support Ticket Integration (Zendesk/Intercom)
# ---------------------------------------------------------------------------
# Provider selection: 'zendesk', 'intercom', or 'both'
SUPPORT_PROVIDER=zendesk

# Zendesk Configuration
ZENDESK_SUBDOMAIN=your-company
ZENDESK_API_TOKEN=your_zendesk_api_token
ZENDESK_USER_EMAIL=support@yourcompany.com
# Optional: Default group ID for routing dispute tickets
ZENDESK_GROUP_ID=
# Optional: Default assignee ID for dispute tickets
ZENDESK_ASSIGNEE_ID=
# Stellar Configuration
STELLAR_NETWORK=testnet
STELLAR_ISSUER_SECRET=

# SEP-02 Federation Server
# The domain served in federation addresses, e.g. "alice*mobilemoney.com"
STELLAR_FEDERATION_DOMAIN=mobilemoney.com
# Full base URL of this service (used in stellar.toml FEDERATION_SERVER line)
STELLAR_FEDERATION_SERVER_URL=https://api.mobilemoney.com

# Other Configuration
PORT=3000
NODE_ENV=development
DATABASE_URL=
REDIS_URL=
RATE_LIMIT_WINDOW_MS=900000
RATE_LIMIT_MAX_REQUESTS=100
REQUEST_SIZE_LIMIT=10mb

# ---------------------------------------------------------------------------
# Response Compression
# ---------------------------------------------------------------------------
# Enable/disable response compression (default: true)
COMPRESSION_ENABLED=true
# Compression threshold in bytes - only compress responses larger than this (default: 1024)
COMPRESSION_THRESHOLD=1024
# Compression level 1-9, where 1 is fastest and 9 is best compression (default: 6)
COMPRESSION_LEVEL=6

# ---------------------------------------------------------------------------
# CORS
# Cache preflight responses to reduce repeated browser OPTIONS requests.
# Value is in seconds. Default: 86400 (24 hours)
# ---------------------------------------------------------------------------
CORS_MAX_AGE=86400

# ---------------------------------------------------------------------------
# Authentication
# ---------------------------------------------------------------------------
ADMIN_API_KEY=dev-admin-key

# ---------------------------------------------------------------------------
# Geolocation (ip-api.com — leave blank for free tier, set for pro tier)
# ---------------------------------------------------------------------------
GEOLOCATION_API_KEY=
# Override the base URL if using a different provider (e.g. MaxMind)
GEOLOCATION_API_BASE=http://ip-api.com/json
# Comma-separated IP prefixes/patterns treated as trusted reverse proxies
# (in addition to RFC-1918 ranges which are always trusted)
# Example: TRUSTED_PROXY_CIDRS=10.100.0.*,172.20.0.*
TRUSTED_PROXY_CIDRS=
JWT_SECRET=replace-with-a-secure-shared-secret
OAUTH_CLIENT_ID=mobile-money-client
OAUTH_CLIENT_SECRET=replace-with-a-secure-client-secret
OAUTH_REDIRECT_URI=http://localhost:3000/oauth/callback
OAUTH_ISSUER=mobile-money-api
OAUTH_AUDIENCE=mobile-money-api
OAUTH_JWT_SECRET=replace-with-a-dedicated-oauth-jwt-secret
OAUTH_DEFAULT_SCOPE=transactions:read reports:read
OAUTH_ACCESS_TOKEN_TTL_SECONDS=3600
OAUTH_REFRESH_TOKEN_TTL_SECONDS=2592000
OAUTH_AUTH_CODE_TTL_SECONDS=300

# ---------------------------------------------------------------------------
# Redis (for distributed locks)
# ---------------------------------------------------------------------------
REDIS_URL=redis://localhost:6379

# ---------------------------------------------------------------------------
# Stellar Network
# ---------------------------------------------------------------------------
STELLAR_NETWORK=testnet
STELLAR_HORIZON_URL=https://horizon-testnet.stellar.org
STELLAR_ISSUER_SECRET=YOUR_STELLAR_SECRET_KEY
STELLAR_RECEIVING_ACCOUNT=GABC... # Anchor's receiving account for SEP-31
STELLAR_ASSET_CODE=USDC
STELLAR_ASSET_ISSUER=G...
STELLAR_WEBHOOK_SECRET=your_stellar_webhook_secret

# SEP-10 Authentication (Web Auth)
# Server signing key for SEP-10 challenge transactions (secret key)
STELLAR_SIGNING_KEY=
# Domain used in manageData operation key and JWT issuer
STELLAR_WEB_AUTH_DOMAIN=https://api.mobilemoney.com
# Home domain for multi-domain SEP-10 setups
STELLAR_HOME_DOMAIN=mobilemoney.com
# Challenge transaction validity in seconds (default: 900 = 15 min)
SEP10_CHALLENGE_EXPIRY=900
# JWT token expiration for SEP-10 (default: 1h)
SEP10_JWT_EXPIRES_IN=1h

# ---------------------------------------------------------------------------
# stellar.toml (SEP-01) — Dynamic TOML Generation
# ---------------------------------------------------------------------------
# Domain used to build server URLs in stellar.toml (no protocol, no trailing slash)
STELLAR_FEDERATION_DOMAIN=mobilemoney.com
# Base URL of this service (overrides domain-derived defaults for all SEP servers)
STELLAR_FEDERATION_SERVER_URL=https://api.mobilemoney.com
# Explicit override for the FEDERATION_SERVER line (optional)
# STELLAR_FEDERATION_SERVER=https://api.mobilemoney.com/federation
# Explicit override for the AUTH_SERVER line (optional — SEP-10)
# STELLAR_AUTH_SERVER=https://api.mobilemoney.com/auth
# Explicit override for the KYC server (optional — SEP-12)
# SEP12_KYC_SERVER=https://api.mobilemoney.com/sep12
# Explicit override for the SEP-24 transfer server (optional)
# SEP24_TRANSFER_SERVER=https://api.mobilemoney.com/sep24
# Explicit override for the SEP-31 direct payment server (optional)
# SEP31_SERVER=https://api.mobilemoney.com/sep31
# Human-readable description appended to the primary asset CURRENCIES entry
STELLAR_ASSET_DESC=USDC stablecoin — anchored 1:1 to USD
# Number of decimal places shown by wallets (default: 7)
STELLAR_ASSET_DECIMALS=7
# Whether the asset is anchored to an off-chain asset (default: true)
STELLAR_ASSET_ANCHORED=true
# Off-chain asset type: fiat | crypto | stock | bond | commodity | realestate | other
STELLAR_ASSET_ANCHOR_TYPE=fiat
# Underlying off-chain asset ticker (default: derived from STELLAR_ASSET_CODE)
STELLAR_ASSET_ANCHOR_ASSET=USD
# Additional currencies as a JSON array of AssetEntry objects (optional)
# STELLAR_EXTRA_ASSETS=[{"code":"EURC","issuer":"G...","status":"live","desc":"Euro Coin"}]
# Organisation info for [DOCUMENTATION] section
ORG_NAME=Mobile Money Anchor
ORG_DBA=
ORG_URL=https://mobilemoney.com
ORG_LOGO=https://mobilemoney.com/logo.png
ORG_DESCRIPTION=Mobile money to Stellar asset anchor
ORG_SUPPORT_EMAIL=support@mobilemoney.com

# ---------------------------------------------------------------------------
# Stellar Channel Accounts Pool (Issue #192)
# ---------------------------------------------------------------------------
# Channel accounts enable high-throughput concurrent transaction submission
# by using multiple accounts to avoid sequence number bottlenecks.
#
# Format: JSON array of channel account credentials
# Example: [{"publicKey":"G...","secretKey":"S..."},{"publicKey":"G...","secretKey":"S..."}]
STELLAR_CHANNEL_ACCOUNTS=

# Pool Configuration
# Maximum time (ms) an account can be locked before auto-release (default: 30000)
CHANNEL_POOL_LOCK_TIMEOUT_MS=30000
# Maximum consecutive errors before disabling an account (default: 5)
CHANNEL_POOL_MAX_ERRORS=5
# Time (ms) to wait before re-enabling a disabled account (default: 60000)
CHANNEL_POOL_RECOVERY_MS=60000
# Maximum queue size for waiting requests (default: 100)
CHANNEL_POOL_MAX_QUEUE=100
# Time (ms) to wait in queue before timing out (default: 10000)
CHANNEL_POOL_QUEUE_TIMEOUT_MS=10000

# ---------------------------------------------------------------------------
# Mobile Money Providers
# ---------------------------------------------------------------------------
MTN_API_KEY=your_mtn_api_key
MTN_API_SECRET=your_mtn_api_secret
MTN_SUBSCRIPTION_KEY=your_mtn_subscription_key

AIRTEL_API_KEY=your_airtel_api_key
AIRTEL_API_SECRET=your_airtel_api_secret

ORANGE_API_KEY=your_orange_api_key
ORANGE_API_SECRET=your_orange_api_secret

# Failover configuration
# Enable automatic provider failover (true/false)
PROVIDER_FAILOVER_ENABLED=false
# Configure backups using PROVIDER_BACKUP_<PRIMARY> variables. Example:
# PROVIDER_BACKUP_MTN=airtel
# PROVIDER_BACKUP_ORANGE=airtel

# ---------------------------------------------------------------------------
# Provider-Specific Transaction Limits (in XAF)
# ---------------------------------------------------------------------------
# MTN limits (default: 100 - 500,000)
MTN_MIN_AMOUNT=100
MTN_MAX_AMOUNT=500000

# Airtel limits (default: 100 - 1,000,000)
AIRTEL_MIN_AMOUNT=100
AIRTEL_MAX_AMOUNT=1000000

# Orange limits (default: 500 - 750,000)
ORANGE_MIN_AMOUNT=500
ORANGE_MAX_AMOUNT=750000

# ---------------------------------------------------------------------------
# Currency / Exchange Rates (exchangerate-api.com)
# Free tier: https://www.exchangerate-api.com/
# If unset the service falls back to static approximate rates.
# ---------------------------------------------------------------------------
EXCHANGE_RATE_API_KEY=your_exchange_rate_api_key

# ---------------------------------------------------------------------------
# Request Timeout
# ---------------------------------------------------------------------------
REQUEST_TIMEOUT_MS=30000

# KYC Transaction Limits (in XAF - Central African Franc)
# These limits enforce daily transaction caps based on user verification levels
# Unverified: Basic account with no identity verification
LIMIT_UNVERIFIED=10000
# Basic: Account with basic identity verification (ID card, phone number)
LIMIT_BASIC=100000
# Full: Account with complete KYC verification (ID, proof of address, selfie)
LIMIT_FULL=1000000

# Per-Transaction Amount Limits (in XAF)
# These limits prevent individual transactions that are too small or too large
# Minimum transaction amount (prevents micro-transactions and spam)
MIN_TRANSACTION_AMOUNT=100
# Maximum transaction amount (fraud prevention for single large transactions)
MAX_TRANSACTION_AMOUNT=1000000

# ---------------------------------------------------------------------------
# AML Monitoring (Anti-Money Laundering)
# ---------------------------------------------------------------------------
# Flag single transactions greater than this threshold
AML_SINGLE_TRANSACTION_THRESHOLD_XAF=1000000
# Flag users whose rolling 24h total exceeds this threshold
AML_DAILY_TOTAL_THRESHOLD_XAF=5000000
# Rolling lookback window used for aggregate checks
AML_ROLLING_WINDOW_HOURS=24
# Rapid in/out transaction detection window
AML_RAPID_WINDOW_MINUTES=15
# Minimum rapid transaction count to trigger structuring alerts
AML_RAPID_TRANSACTION_COUNT=3
# Minimum value to consider a transaction as possible structuring
AML_STRUCTURING_FLOOR_XAF=100000
# GraphQL (/graphql) — optional in development; required in production (NODE_ENV=production)
GRAPHQL_API_KEY=
# Optional label for the authenticated principal (returned by the `me` query)
GRAPHQL_CLIENT_SUBJECT=api-client

# Scheduled Jobs
# Cron expressions (defaults shown)
CLEANUP_CRON=0 2 * * *
REPORT_CRON=0 6 * * *
STATUS_CHECK_CRON=0 * * * *
ACCOUNT_MERGE_CRON=0 3 * * *

# Cleanup: retain completed/failed transactions for this many days (default: 90)
LOG_RETENTION_DAYS=90

# Status check: minutes before a pending transaction is considered stuck (default: 60)
STUCK_TRANSACTION_MINUTES=60

# Account merge: merge inactive auxiliary Stellar accounts to reclaim base reserves
# Comma-separated Stellar secret keys for merge source accounts
STELLAR_AUXILIARY_ACCOUNT_SECRETS=
# Destination account for merged balances. If unset, the issuer account is used.
STELLAR_ACCOUNT_MERGE_DESTINATION=
# Number of inactive days required before an auxiliary account is eligible
ACCOUNT_MERGE_INACTIVITY_DAYS=30
# Set to true to log merge candidates without submitting transactions
ACCOUNT_MERGE_DRY_RUN=false

# --- Email Configuration (Nodemailer) ---
SMTP_HOST=smtp.ethereal.email
SMTP_PORT=587
SMTP_USER=your_smtp_user
SMTP_PASS=your_smtp_password
EMAIL_FROM="Mobile Money" <no-reply@mobilemoney.com>

# ---------------------------------------------------------------------------
# AWS S3 Configuration (for KYC document uploads)
# ---------------------------------------------------------------------------
AWS_REGION=us-east-1
AWS_ACCESS_KEY_ID=your_aws_access_key_id
AWS_SECRET_ACCESS_KEY=your_aws_secret_access_key
AWS_S3_BUCKET=mobile-money-kyc-documents

# KYC Provider Configuration
KYC_API_URL=https://api.entrust.com
KYC_API_KEY=your_kyc_api_key
KYC_WEBHOOK_SECRET=your_webhook_secret

# --- Twilio Configuration ---
TWILIO_ACCOUNT_SID=your_twilio_account_sid
TWILIO_AUTH_TOKEN=your_twilio_auth_token
TWILIO_PHONE_NUMBER=your_twilio_sms_number
SMS_PROVIDER=twilio # 'twilio' or 'none'

# WhatsApp Official API (Twilio)
WHATSAPP_ENABLED=false
TWILIO_WHATSAPP_NUMBER=whatsapp:+14155238886
TWILIO_WHATSAPP_TRANSACTION_TEMPLATE_SID=HX...
TWILIO_WHATSAPP_OTP_TEMPLATE_SID=HX...
USE_HTTP2=false  # Set to true with valid certs to enable HTTP/2

# Intercom Configuration
INTERCOM_ACCESS_TOKEN=your_intercom_access_token
# Optional: Admin ID for sending messages
INTERCOM_ADMIN_ID=

# Support API Timeout and Retry Configuration
SUPPORT_API_TIMEOUT_MS=10000
SUPPORT_RETRY_ATTEMPTS=3
SUPPORT_RETRY_DELAY_MS=1000

# Refresh Token
REFRESH_TOKEN_EXPIRES_IN=
REFRESH_TOKEN_SECRET=
REFRESH_TOKEN_ISSUER=

# ---------------------------------------------------------------------------
# Provider Health Check
# ---------------------------------------------------------------------------
# Cron schedule for provider health checks (default: every 5 minutes)
PROVIDER_HEALTH_CHECK_CRON=*/5 * * * *
# Webhook URLs for provider health alerts (comma-separated or individual)
PROVIDER_HEALTH_WEBHOOK_URL=
# SLACK_ALERTS_WEBHOOK_URL and PAGERDUTY_WEBHOOK_URL can also be used

# ---------------------------------------------------------------------------
# PII Encryption (AES-256-GCM)
# ---------------------------------------------------------------------------
# Global key material for encrypting PII fields (name, address, id_number).
# Must be a high-entropy secret (>=32 chars). Never commit real values.
# Generate with: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
DB_ENCRYPTION_KEY=replace-with-a-secure-32-char-key
# Master key for per-user HKDF key derivation. Keep separate from DB_ENCRYPTION_KEY.
PII_MASTER_KEY=replace-with-a-different-secure-32-char-key

# ---------------------------------------------------------------------------
# Automatic Persisted Queries (APQ)
# ---------------------------------------------------------------------------
# TTL in seconds for APQ hash→query entries stored in Redis (default: 86400 = 24h)
APQ_TTL_SECONDS=86400

# ---------------------------------------------------------------------------
# GraphQL Subscriptions (Redis PubSub)
# ---------------------------------------------------------------------------
# REDIS_URL is already used above — the same instance is used for PubSub.
# JWT_SECRET is required for authenticating WebSocket connections.
# Clients must pass: connectionParams: { authToken: "<jwt>" }
JWT_SECRET=replace-with-a-secure-jwt-secret
# Provider balance cache TTL (seconds)
PROVIDER_BALANCE_CACHE_TTL=60