.env.example

# --- Embedded database (libsql file mode) ---
DATABASE_URL=file:./data/minesweeper.db

# --- Local file storage for uploads / extracted originals / crops ---
UPLOAD_DIR=./data/uploads

# --- Stage 3 extractor ---
# "stub"     = deterministic heuristic extractor (default; GPU-free, used by tests)
# "hybrid"   = text-layer docs → stub; image-only (scanned/hindex) docs → vlm (image name OCR)
# "vlm"      = single on-prem model via an OpenAI-compatible endpoint (local vLLM / Ollama)
# "ensemble" = multiple LOCAL vLLM models voted together (see scripts/serve-ocr.sh)
EXTRACTOR_MODE=stub

# Single-model VLM (OpenAI-compatible). Defaults below point at a local Ollama instance.
VLM_BASE_URL=http://localhost:11434/v1
VLM_API_KEY=ollama
VLM_MODEL=qwen3.5:9B
VLM_TIMEOUT_MS=120000
# Max document text (chars) sent to the VLM. Names live in the front matter, so a small cap keeps
# the prompt within the model's context window — large reports (수백 쪽) otherwise overflow → HTTP 400.
VLM_MAX_TEXT_CHARS=12000
# Max PDF pages parsed for text. Names are in the front matter; parsing all pages of a huge report
# (수백~수천 쪽) is wasted CPU and the main ingest slowness.
PDF_MAX_PAGES=20

# Ensemble (EXTRACTOR_MODE=ensemble) — comma-separated `baseUrl|model` (all LOCAL, no external API).
# Agreement across models = confidence; disagreements are routed to human review.
VLM_ENSEMBLE="http://localhost:8010/v1|Qwen/Qwen2.5-VL-7B-Instruct,http://localhost:8011/v1|OpenGVLab/InternVL3-8B,http://localhost:8012/v1|zai-org/GLM-4.1V-9B-Thinking"
VLM_ENSEMBLE_MIN_VOTES=1   # drop names found by fewer than N models (1 = keep all, route low-agreement to human)

# Seal/signature/handwriting DETECTION (opt-in). Renders the relevant page(s) and asks the VLM
# WHERE stamps/signatures are (it does NOT read 전서체 seals) → review queue with a crop. Needs a
# local VLM up + VLM_MODEL set. For a local vLLM Qwen2.5-VL server, use:
#   VLM_BASE_URL=http://localhost:8010/v1  VLM_API_KEY=local  VLM_MODEL=Qwen2.5-VL-7B-Instruct
DETECT_MARKS=0
# Doc types that actually carry 도장/서명/날인 — detection runs ONLY on these. Running it on a
# google-scholar capture (hindex) or a journal PDF makes the VLM hallucinate "handwriting" regions.
DETECT_MARK_DOCTYPES=degree_thesis,research_project

# --- Background worker ---
WORKER_POLL_INTERVAL_MS=2000
# A job claimed this many times without completing is parked as error (dead letter).
JOB_MAX_ATTEMPTS=3
# Page-render cache TTL (days) — renders are re-created on demand; old ones are pruned by the worker.
RENDER_CACHE_TTL_DAYS=7

# --- Backups (scripts/backup-data.ts) ---
# BACKUP_DIR=./data/backups
# BACKUP_KEEP=14

# --- Upload / unzip safety limits (zip-bomb / DoS guards) ---
MAX_UPLOAD_BYTES=209715200          # 200 MB max zip upload
MAX_ZIP_ENTRIES=5000                # max files per zip
MAX_ZIP_TOTAL_BYTES=524288000       # 500 MB max total uncompressed size

# --- Local login (Phase 1 auth) ---
# Session-cookie HMAC key. scripts/create-user.ts generates one into .env automatically on
# first run. NEVER commit the real value (the repo is public).
AUTH_SECRET=replace-me-64-hex-chars
# Create/update an account: npx tsx scripts/create-user.ts <username> <password>

# SECURITY: local login gates all pages and APIs (middleware). Still deploy on an internal
# network only — single shared admin account, no rate limiting, plain http on the LAN.