.env.example

# Copy to .env.local and fill in values

# ── Web app (required) ───────────────────────────────────────────────

# Azure Database for PostgreSQL — use PgBouncer port 6432 for Vercel serverless
# The webtv_app role is scoped to the webtv schema only (see sql/schema.sql)
DATABASE_URL=postgresql://user:PASSWORD@server.postgres.database.azure.com:6432/db?sslmode=require

# Speech-to-text is routed per language (see lib/providers/config.ts STT_ROUTING).
# The web app therefore needs the keys for every routed provider:
#   floor (multilingual) → Gemini   ·   English → AssemblyAI
#   fr/es/ar/ru → Azure OpenAI       ·   Chinese → Alibaba (DashScope)
# Gemini is also used for PV document alignment.
GEMINI_API_KEY=
ASSEMBLYAI_API_KEY=
DASHSCOPE_API_KEY=

# Topics & Analysis (GPT-5.4) + fr/es/ar/ru transcription (gpt-4o-transcribe)
AZURE_OPENAI_ENDPOINT=https://{resource}.openai.azure.com/
AZURE_OPENAI_API_VERSION=2025-03-01-preview
AZURE_OPENAI_API_KEY=

# Auth — magic-link login. Required to generate transcripts. Experimental
# features (proposition analysis, speaker directory) additionally require the
# per-user `experimental_access` flag, toggled directly in psql.
# Auth tables live in the webtv schema (apply sql/migrations/002_add_auth_tables.sql).
AUTH_SECRET=                       # openssl rand -hex 32
SMTP_HOST=smtp.mailbox.org
SMTP_PORT=587
SMTP_USER=
SMTP_PASS=
SMTP_FROM=                         # falls back to SMTP_USER if unset

# ── Web app (optional) ──────────────────────────────────────────────

# Vercel cron job auth (auto-set by Vercel in production)
# CRON_SECRET=

# Public base URL for links in outbound email (magic-link sign-in, transcript
# notifications). Normally inferred from the request host / Vercel system vars,
# so this is only an explicit override. Defaults to http://localhost:3000.
# BASE_URL=

# Daily caps on transcript starts (count-based, env-overridable, reset at UTC
# midnight). Per-user keeps any one account from running away with cost;
# global is the aggregate ceiling and trips a Sentry "global_daily_ceiling"
# warning when exceeded.
# TRANSCRIBE_USER_DAILY_LIMIT=5
# TRANSCRIBE_GLOBAL_DAILY_LIMIT=50

# Postgres pool — per Vercel instance. PgBouncer (port 6432) does the real
# fan-in, so a small per-instance pool is the right shape. Long-running
# scripts can override.
# PG_POOL_MAX=2
# PG_SSL_CA=                         # PEM path; only if Azure's chain ever leaves Node's bundle

# Sentry (errors + user feedback widget). DSN is public; the auth token is
# only used at build time to upload source maps and should be Vercel-only.
# NEXT_PUBLIC_SENTRY_DSN=
# SENTRY_DSN=                        # same value as above; used server-side
# SENTRY_ORG=
# SENTRY_PROJECT=
# SENTRY_AUTH_TOKEN=                 # Vercel env only — never commit
# SENTRY_TRACES_SAMPLE_RATE=0        # raise to 0.1 etc. to enable perf tracing

# Umami analytics (privacy-first, cookieless). Set the website ID from your
# Umami dashboard; override SRC if self-hosted.
# NEXT_PUBLIC_UMAMI_WEBSITE_ID=
# NEXT_PUBLIC_UMAMI_SRC=https://cloud.umami.is/script.js

# Search engine site ownership verification (Search Console / Bing Webmaster
# Tools). Each console hands you a token after you add the property; paste it
# here and redeploy. Both consoles also accept DNS-record verification as an
# alternative — use whichever your DNS/deploy story prefers.
# GOOGLE_SITE_VERIFICATION=
# BING_SITE_VERIFICATION=

# ── Eval system only ────────────────────────────────────────────────
# Extra STT providers benchmarked in eval/ but not used by the web app.
# (ASSEMBLYAI_API_KEY and DASHSCOPE_API_KEY are above — they are now required.)

ELEVENLABS_API_KEY=
AZURE_SPEECH_KEY=
AZURE_SPEECH_ENDPOINT=
GROQ_API_KEY=
DEEPGRAM_API_KEY=
MISTRAL_API_KEY=

# HuggingFace (corpus & results upload)
HF_TOKEN=

# Google Cloud (Chirp STT)
GOOGLE_APPLICATION_CREDENTIALS=
GOOGLE_CLOUD_BUCKET=