.env.example

# Authentication
AUTH_URL=http://localhost:3000
AUTH_SECRET=
AUTH_COGNITO_CLIENT_ID=
AUTH_COGNITO_ISSUER=https://cognito-idp.us-east-1.amazonaws.com/YOUR_USER_POOL_ID
# Dedicated oidc-provider cookie key. FrontendStackEcs creates and injects this
# automatically in AWS. Required for non-CDK production deployments; local
# development falls back to AUTH_SECRET.
# OIDC_COOKIE_SECRET=

# Public Authentication Variables (Client-side)
NEXT_PUBLIC_COGNITO_USER_POOL_ID=
NEXT_PUBLIC_COGNITO_CLIENT_ID=
NEXT_PUBLIC_COGNITO_DOMAIN=
NEXT_PUBLIC_AWS_REGION=us-east-1

# =============================================================================
# Database Configuration
# =============================================================================
# Option 1: Local Development (PostgreSQL via Docker)
# Run: npm run db:up to start local PostgreSQL
DATABASE_URL=postgresql://postgres:postgres@localhost:5432/aistudio
DB_SSL=false

# Option 2: AWS Aurora (production/staging) - Comment out DATABASE_URL above and use:
# DB_HOST=your-aurora-cluster.rds.amazonaws.com
# DB_PORT=5432
# DB_USER=your_username
# DB_PASSWORD=your_password
# DB_NAME=aistudio
# DB_SSL=true  # Required for AWS Aurora

# Connection pool settings (optional)
# DB_MAX_CONNECTIONS=20
# DB_IDLE_TIMEOUT=20
# DB_CONNECT_TIMEOUT=10

# Optional - Debugging
SQL_LOGGING=false

# Optional - Session Configuration
# SESSION_MAX_AGE=86400  # Session max age in seconds (default: 24 hours)

# Optional - Token Configuration
# COGNITO_ACCESS_TOKEN_LIFETIME_SECONDS=3600  # Token lifetime in seconds (default: 1 hour)

# AI Model Providers (Local Development Only)
# AWS Bedrock - These are ignored in production (uses IAM role)
# BEDROCK_ACCESS_KEY_ID=
# BEDROCK_SECRET_ACCESS_KEY=
# BEDROCK_REGION=us-east-1

# Other AI Providers (Optional)
# OPENAI_API_KEY=
# GOOGLE_API_KEY=
# AZURE_OPENAI_KEY=
# AZURE_OPENAI_ENDPOINT=
# AZURE_OPENAI_RESOURCENAME=

# =============================================================================
# MCP Connector Token Encryption (Local Development Only)
# =============================================================================
# In production, the DEK is fetched from AWS Secrets Manager.
# For local dev, set this to any random string to avoid needing AWS credentials.
# Example: openssl rand -base64 32
# MCP_TOKEN_ENCRYPTION_KEY=

# =============================================================================
# Atrium Content Workspace (Issue #1058, Phase 0)
# =============================================================================
# System user ID for content created autonomously by agents (not a logged-in human).
# Required for any autonomous-agent content write path (Phase 5+). Must be the
# numeric DB id of a service account user in the users table.
# ATRIUM_SYSTEM_USER_ID=

# --- Atrium real-time collaboration (Issue #1051, Phase 1) -------------------
# Dedicated signing key for collab session tokens. These tokens ride in the
# websocket URL (?token=...) and so end up in ALB/proxy access logs — they must
# NOT share AUTH_SECRET (the session-cookie key). REQUIRED in production. In
# development the code falls back to AUTH_SECRET if this is unset.
# COLLAB_JWT_SECRET=
#
# Redis fan-out for the collab server (multi-instance convergence). Unset = local
# single-instance mode (no fan-out). REDIS_TLS=1 wraps the connection in TLS.
# REDIS_HOST=
# REDIS_PORT=6379
# REDIS_TLS=
#
# Collab persist debounce (ms). Each room writes at most one atrium_doc_state row
# per window during active editing; lower = more DB writes/minute per room.
# Default: 1500.
# COLLAB_PERSIST_DEBOUNCE_MS=1500
#
# Max concurrent websocket connections per document room (memory bound against a
# client repeatedly opening sockets to one room). Set explicitly to 0 to disable
# the cap; a blank / non-numeric value falls back to the default (it does NOT
# disable the cap). Default: 50.
# COLLAB_MAX_CONNS_PER_ROOM=50
#
# Max bytes for a single inbound collab websocket frame (per-frame allocation
# bound: an authenticated user could otherwise send one ~100 MB Yjs frame and OOM
# the task). Set explicitly to 0 to disable; a blank / non-numeric value falls back
# to the default (it does NOT disable the cap). Default: 8388608 (8 MB).
# COLLAB_MAX_FRAME_BYTES=8388608
#
# Agent-bridge settle delay (ms) after dispatching an agent edit before the bridge
# closes its sync socket. Heuristic (not an ack); raise under ECS/Redis load if
# agent edits intermittently fail to land. Default: 500.
# COLLAB_AGENT_SETTLE_MS=500
#
# Override the collab loopback target the agent bridge connects to (ECS task defs
# where PORT differs from server.ts's bind port). Default: ws://127.0.0.1:$PORT.
# Must use ws:// or wss:// and resolve to an allowlisted host (loopback by
# default) — this carries a signed collab JWT, so an arbitrary host is an SSRF /
# token-exfiltration risk and is rejected.
# COLLAB_INTERNAL_URL=
#
# Comma-separated extra hostnames the agent bridge may connect to beyond the
# loopback defaults (127.0.0.1, localhost, ::1). Only set when COLLAB_INTERNAL_URL
# points at a non-loopback internal host. Default: empty.
# COLLAB_INTERNAL_HOST_ALLOWLIST=

# --- Atrium artifact sandbox (Issue #1052, Phase 2) --------------------------
# The SEPARATE origin (distinct subdomain / CloudFront distribution) that serves
# the locked-down artifact host page. UNTRUSTED artifact code (HTML/JS) renders
# ONLY here, in a cross-origin sandboxed iframe — never on the app origin. This is
# a PUBLIC URL (not a secret). MUST NOT equal NEXT_PUBLIC_APP_URL (a same-origin
# "sandbox" is not a sandbox and the app fails closed if they match).
#
# DEPLOYED ENVIRONMENTS: do NOT set this by hand. AIStudio-AtriumSandboxStack
# creates the CloudFront origin and the CDK frontend stack injects it into the ECS
# task as ATRIUM_SANDBOX_ORIGIN automatically (cross-stack ref, #1052). The server
# resolves the iframe src from it and passes it to <ArtifactSandbox> as a prop, and
# middleware builds the CSP frame-src from it at runtime — so NO build-time
# NEXT_PUBLIC value and no manual step are needed.
#
# LOCAL DEV ONLY: set ATRIUM_SANDBOX_ORIGIN to test the artifact preview against a
# reachable sandbox host (e.g. a deployed dev sandbox). NEXT_PUBLIC_ is no longer
# required (kept as an optional legacy fallback in the config/middleware resolvers).
# ATRIUM_SANDBOX_ORIGIN=https://artifacts-dev.aistudio.psd401.ai
#
# Comma-separated CDN origins the sandbox CSP permits for artifact
# script-src/style-src (e.g. https://cdnjs.cloudflare.com). Empty = inline-only
# artifacts (no external CDN scripts). Set the SAME value as the CDK context
# `atriumAllowedArtifactCdns` so the host CSP and any app-side validation agree.
# ATRIUM_ALLOWED_ARTIFACT_CDNS=https://cdnjs.cloudflare.com

# --- Atrium publishing connectors (Issue #1057, Phase 7) ---------------------
# Base URL for Atrium reader deep links (internal `/c/[slug]` and the anonymous
# public `/p/[slug]` reader). The `public_web` publish adapter records
# `${ATRIUM_PUBLIC_BASE_URL}/p/{slug}` as the publication's external_ref, and the
# REST/MCP surfaces return `${ATRIUM_PUBLIC_BASE_URL}/c/{slug}` as the deep link.
# No trailing slash (it is stripped). ECS injects the canonical app origin
# automatically; set this only for local/non-CDK runtimes. When unset, links
# degrade to relative paths (`/c/{slug}`, `/p/{slug}`). §33 #7 is resolved to the
# authenticated-but-anonymous Next public route, so this is the app origin (no
# separate CloudFront/S3 public distribution).
# ATRIUM_PUBLIC_BASE_URL=https://aistudio.psd401.ai
#
# Redis AUTH token for the Atrium collab cache. Injected automatically from
# Secrets Manager in ECS (do not set by hand there). Set only for a local Redis
# that requires AUTH. Default: empty (no auth — local dev only).
# REDIS_PASSWORD=