.env.example

# Web app env — copy to `apps/web/.env.local`. Next.js loads .env.local from THIS
# directory (apps/web), NOT the repo root.
#
# The conversational chat is served same-origin: next.config.ts wraps the config
# with `withEve()`, which spawns the Eve agent (apps/agent) and proxies /eve/v1/*
# to it, so the browser streams turns via useEveAgent with no Eve URL to set. The
# agent's own model env stays in apps/agent/.env.local (AI_GATEWAY_API_KEY).

# --- Everything below is optional: each has a working local default ---

# Postgres. Defaults to the local docker instance below when unset.
# DATABASE_URL=postgres://tendnote:tendnote@localhost:55432/tendnote
# Optional. Tendnote requires the transaction-capable Postgres driver, including for
# Neon databases. Leave unset or set explicitly to "postgres".
# DATABASE_DRIVER=postgres

# Redis for Better Auth sessions. Defaults to the local docker instance below.
# REDIS_URL=redis://localhost:56379

# Better Auth. A local dev secret is used automatically when unset; both are
# REQUIRED in production. Generate a secret with `openssl rand -base64 32`.
# BETTER_AUTH_URL=http://localhost:3000
# BETTER_AUTH_SECRET=

# Background job recovery cron. REQUIRED in production and preview: the route now
# FAILS CLOSED without it (Vercel Cron sends `Authorization: Bearer $CRON_SECRET`).
# Generate with `openssl rand -base64 32`. For local, unauthenticated calls to
# /api/cron/background-jobs set ALLOW_UNAUTHENTICATED_CRON=true — it is ignored in
# production and preview.
# CRON_SECRET=
# ALLOW_UNAUTHENTICATED_CRON=false

# Background job queue callback authenticity. `@vercel/queue` does not authenticate
# inbound callbacks, so payloads are HMAC-signed at publish and verified at the consumer
# routes (/api/queue/*), which FAIL CLOSED in production and preview when no secret is
# resolved. Optional: defaults to BETTER_AUTH_SECRET. If set, it MUST be the SAME value
# here and in the Eve agent deployment, which also publishes to these queues.
# BACKGROUND_JOB_QUEUE_SECRET=

# Transactional email (Resend). REQUIRED in production: without the key and the
# explicit support mailbox below, a Household Invitation is recorded as a
# delivery failure and the Owner is told so, rather than a live capability URL
# being written into a hosted log. `vitest` never sends whatever is set here.
# Operator setup, the exact Cloudflare DNS records, and the send checklist:
# docs/email-setup.md.
# RESEND_API_KEY=
# Set both operator-owned identities for a real deployment. These reserved
# examples are safe local/test values and cannot route to a real mailbox.
# TENDNOTE_EMAIL_FROM=Tendnote <notifications@mail.tendnote.example>
# TENDNOTE_EMAIL_REPLY_TO=support@example.test

# Web Push reminders (Phase 7). These are not needed to install or use the PWA,
# but all three are REQUIRED for working end-to-end reminder notifications.
# Generate one stable pair with:
#   pnpm --filter @tendnote/web exec web-push generate-vapid-keys --json
# The public key is embedded in the browser bundle at build time; keep the private
# key server-only. Use a monitored mailto: or https: contact URI for the subject.
# Rotating the pair requires existing installations to subscribe again.
# NEXT_PUBLIC_WEB_PUSH_VAPID_PUBLIC_KEY=
# WEB_PUSH_VAPID_PRIVATE_KEY=
# WEB_PUSH_VAPID_SUBJECT=mailto:you@example.com
#
# Optional comma-separated allowlist of push provider hosts, `*.` wildcards
# allowed. Leave it unset to accept any public host: subscription endpoints are
# refused if they resolve to a private, loopback, link-local, or metadata
# address whether or not this is set, so this only narrows an already-closed
# door for a deployment that knows exactly which providers it serves.
# WEB_PUSH_ENDPOINT_ALLOWLIST=fcm.googleapis.com,updates.push.services.mozilla.com,*.notify.windows.com,*.push.apple.com

# GitHub sign-in (Phase 2A, optional). Set BOTH to enable the "Continue with
# GitHub" button; leave either unset and it's hidden. Authorization callback URL:
# <BETTER_AUTH_URL>/api/auth/callback/github. Google sign-in is intentionally not
# offered here.
# GITHUB_CLIENT_ID=
# GITHUB_CLIENT_SECRET=

# Google integrations (Phase 2C Calendar, Phase 2D Gmail, optional). Set BOTH to
# enable Google capability connect flows via Better Auth's Google provider +
# linkSocial. Authorization callback URL:
# <BETTER_AUTH_URL>/api/auth/callback/google. Calendar requests
# calendar.events.readonly; Gmail requests gmail.compose. No Contacts scopes.
# Operator setup + smoke checklists: docs/google-setup.md.
# GOOGLE_CLIENT_ID=
# GOOGLE_CLIENT_SECRET=

# Discord identity linking (ADR-0138, optional). Set BOTH to enable the Discord
# connect flow via Better Auth's Discord provider + linkSocial. These are the
# server-only OAuth CLIENT credentials; the interaction/bot secrets live in the
# agent app (apps/agent/.env.local: DISCORD_PUBLIC_KEY / _APPLICATION_ID /
# _BOT_TOKEN). Authorization callback URL:
# <BETTER_AUTH_URL>/api/auth/callback/discord. Only the `identify` scope is
# requested (never `email`), so phone-only Discord accounts link cleanly. Linking
# is the PRODUCTION path that establishes the owner inbound Discord interactions
# resolve to; the agent's DISCORD_OWNER_USER_MAP is a dev-only fallback, ignored
# in production. Operator setup + smoke checklists: docs/discord-setup.md.
# DISCORD_CLIENT_ID=
# DISCORD_CLIENT_SECRET=

# Private Beta Access (Phase 2A). Evaluated server-side via Vercel Flags; the
# first signup bootstraps the initial owner, later signups stay pending until
# the flag (or a persisted grant) admits them.
#
# Vercel deployments receive the OIDC token automatically. For local dashboard-
# backed flag evaluation, link the project with `vercel link`, then run
# `vercel env pull` from apps/web so the OIDC env lands in .env.local.
# Authorizes the Flags Explorer discovery endpoint (/.well-known/vercel/flags).
# Generate with `openssl rand -base64 32`. Without it the endpoint stays locked.
# FLAGS_SECRET=

# Server-only Vercel AI Gateway credentials. These are not exposed to the
# browser unless a variable is prefixed with NEXT_PUBLIC_. Eve chat model
# credentials stay in apps/agent/.env.local, but the web server can also call
# shared DB capture/snapshot code from server actions and pages.
#
# Leave these unset for the default offline local behavior. Add them only when
# the web server itself should generate live relationship snapshots or real
# semantic embeddings.
# AI_GATEWAY_API_KEY=
# VERCEL_OIDC_TOKEN=
# Optional local-development opt-in for the bounded AI ordering of optional
# Today items. Development is deterministic by default so the home page does
# not wait on a gateway call; the ranker still has a tight timeout when enabled.
# TENDNOTE_ENABLE_TODAY_RANKING=1
# Snapshot model id. Defaults to TENDNOTE_AGENT_MODEL, then google/gemini-3.7-flash.
# TENDNOTE_SNAPSHOT_MODEL=google/gemini-3.7-flash
# Semantic embedding model id. Defaults to openai/text-embedding-3-small when
# AI Gateway credentials are present, otherwise local dev falls back to
# deterministic fake vectors.
# TENDNOTE_EMBEDDING_MODEL=openai/text-embedding-3-small
# Structured Suggested Memory and General Action extraction. Defaults to the stable,
# cost-efficient extraction tier below when unset.
# TENDNOTE_EXTRACTION_MODEL=google/gemini-3.1-flash-lite
# TENDNOTE_EMBEDDING_VERSION=openai/text-embedding-3-small
# Use "enqueue_only" if web captures should only create embedding jobs for a
# separate agent/worker process to handle.
# TENDNOTE_EMBEDDING_RUNTIME=inline

# Optional private-beta fallback for Today and conversational-capture local-date
# calculations when no persisted owner daily-schedule timezone is available.
# TENDNOTE_OWNER_TIMEZONE=America/Chicago

# Dev-only owner used by the local demo-session bridge and local fixtures.
# TENDNOTE_DEV_OWNER_USER_ID=demo-user
# Optional dev-only Better Auth email for the fallback owner. Set this to the
# Gmail address you connect locally so Google account linking can match it.
# TENDNOTE_DEV_OWNER_EMAIL=you@example.com