.env.example

PORT=4000

# ── Lit Protocol / Chipotle ─────────────────────────────────────────
# Lit Action CID used by /lit/secure-view. Pinned to IPFS for
# provenance + audit; the source is also shipped INLINE to Chipotle
# (`/core/v1/lit_action`), so this CID is used only to stamp
# `delegation.actionIpfsId` at /lit/begin-session and to verify
# `del.actionIpfsId === jsParams.actionIpfsId` inside the Lit Action.
#
# V1.2 sigauth Lit Actions (the only path; legacy actions removed in
# Phase 5 cleanup, 2026-04-21):
#   non-media-decrypt-chipotle.js
#     → bafkreihvm4zkyuefnuptlbdins6cmd2mbslj2xgnyzz3ssdg2ggg3jtkk4
#   media-decrypt-chipotle.js
#     → bafkreihw7brius3xw2u7ltjac26hoqudulkc6mfwqrjxtrobanz2ryhvsq
#
# To rotate: re-pin, run the three Chipotle calls in `docs/core/
# LIT_CHIPOTLE_MIGRATION.md` §"After Any Code Change to Lit Action
# Scripts", then update LIT_ACTION_CID. Existing user delegations
# become invalid (one extra wallet popup on next asset open) — this
# is intentional and signals a security event.
LIT_ACTION_CID=bafkreihvm4zkyuefnuptlbdins6cmd2mbslj2xgnyzz3ssdg2ggg3jtkk4

# Media CEK recovery action (DASH/CENC playback). On V1.2 Chipotle
# the media path routes through recoverNonMediaCEK and therefore uses
# LIT_ACTION_CID. MEDIA_ACTION_CID is reserved for a future split if
# media verification logic ever diverges from non-media.
MEDIA_ACTION_CID=bafkreihw7brius3xw2u7ltjac26hoqudulkc6mfwqrjxtrobanz2ryhvsq

# Backend selector. Default "chipotle" uses the Chipotle REST API
# (PKP-AES). "datil" falls back to the legacy Datil SDK (threshold BLS,
# only needed to read pre-migration assets).
LIT_BACKEND=chipotle