.env.example

# Database Configuration (PostgreSQL)
DATABASE_URL="postgresql://username:password@localhost:5432/craft_db?schema=public"
# Direct (non-pooled) connection for Prisma migrations (required for Neon/PgBouncer)
DATABASE_URL_UNPOOLED="postgresql://username:password@localhost:5432/craft_db?schema=public"

# Better Auth Configuration
BETTER_AUTH_SECRET=your-super-secret-jwt-secret-change-in-production-minimum-32-chars
BETTER_AUTH_URL=http://localhost:3000
NEXT_PUBLIC_BETTER_AUTH_URL=http://localhost:3000

# =============================================================================
# SERVICE URLs (cross-service navigation & API calls)
# =============================================================================

NEXT_PUBLIC_WEBSITE_URL=http://localhost:3001
NEXT_PUBLIC_APP_URL=http://localhost:3000

# Internal API secret for service-to-service communication
INTERNAL_API_SECRET=your-internal-api-secret-min-32-chars

# =============================================================================
# ADMIN PANEL (Bootstrap)
# =============================================================================
# The first user to visit /admin whose email matches this will be auto-promoted
# to admin. Only used when NO admin users exist yet. After that, manage admins
# from the admin panel (/admin/users → change role).
SUPER_ADMIN_EMAIL="you@example.com"

# Google OAuth (for user authentication - get from Google Cloud Console)
GOOGLE_CLIENT_ID=your-google-client-id
GOOGLE_CLIENT_SECRET=your-google-client-secret

# GitHub OAuth (for repo integration - get from GitHub Developer Settings)
GITHUB_CLIENT_ID=your-github-client-id
GITHUB_CLIENT_SECRET=your-github-client-secret

# GitHub App (for repo integration)
GITHUB_APP_ID="123456"
GITHUB_APP_CLIENT_ID="Iv1.xxxxxxxxxx"
GITHUB_APP_CLIENT_SECRET="your-client-secret"
GITHUB_APP_PRIVATE_KEY="-----BEGIN RSA PRIVATE KEY-----\n...\n-----END RSA PRIVATE KEY-----"
GITHUB_APP_SLUG="craft-code-sync"

# Figma OAuth Integration (for design imports)
# Create OAuth app: https://www.figma.com/developers/apps
# 1. Set Redirect URL to: http://localhost:3000/api/integrations/figma/callback
# 2. Copy the Client ID and Client Secret
FIGMA_CLIENT_ID=your_figma_client_id
FIGMA_CLIENT_SECRET=your_figma_client_secret

# =============================================================================
# AI PROVIDER CONFIGURATION (Multi-Provider Support)
# =============================================================================
# Craft supports multiple AI providers with direct SDK integration
# You can use any combination of these providers based on your needs
# See docs/multi-provider-ai-setup.md for detailed setup guide
# =============================================================================

# Anthropic API key for Claude models (https://console.anthropic.com)
# Direct integration via @ai-sdk/anthropic
# Models: Claude Sonnet 4.5, Claude Haiku 4.5, Claude 3 Opus
# Best for: Coding tasks, conversations, reasoning
ANTHROPIC_API_KEY=your-anthropic-api-key

# OpenAI API key for GPT models (https://platform.openai.com)
# Direct integration via @ai-sdk/openai
# Models: GPT-5, GPT-5 Mini, GPT-5 Codex, GPT-OSS-20B
# Best for: Code generation, fast responses, project naming
OPENAI_API_KEY="your-openai-api-key"

# Google AI API key for Gemini models (https://ai.google.dev)
# Direct integration via @ai-sdk/google
# Models: Gemini 2.5 Flash, Gemini 2.5 Pro
# Best for: Multimodal tasks, large context windows (1M+ tokens)
GOOGLE_GENERATIVE_AI_API_KEY="your-google-generative-ai-api-key"

# xAI API key for Grok models (https://console.x.ai)
# Direct integration via @ai-sdk/xai
# Models: Grok 4 Fast
# Best for: Memory generation, massive context (2M tokens)
XAI_API_KEY="your-xai-api-key"

# OpenRouter API key for aggregated models (https://openrouter.ai)
# Direct integration via @openrouter/ai-sdk-provider
# Models: MiniMax M2, Kimi K2 Thinking, and various other models
# Best for: Access to multiple models through a single API
OPENROUTER_API_KEY=your-openrouter-api-key

# AI Gateway API key for additional provider access (https://aigateway.io)
# Direct integration via @ai-sdk/ai-gateway
# Models: Access to various models from different providers
# Best for: Expanding model options and redundancy
AI_GATEWAY_API_KEY=your_ai_gateway_api_key

# NOTE: At least ONE provider API key is required for Craft to function
# Models are automatically selected based on use case, user plan, and tier
# The system dynamically routes requests to the appropriate provider

# =============================================================================
# E2B SANDBOX (Cloud Code Interpreter)
# =============================================================================
# E2B provides isolated cloud sandboxes for running user code
# Get API key from: https://e2b.dev/dashboard
# =============================================================================

# E2B Code Interpreter (for app preview)
E2B_API_KEY=your_e2b_api_key

# E2B template IDs (built with pnpm e2b:build:dev / e2b:build:prod)
E2B_TEMPLATE_ID=craft-node
E2B_SCREENSHOT_TEMPLATE_ID=craft-screenshot

# =============================================================================
# Resend Email — Platform Transactional Emails (OTPs, password resets, billing)
# =============================================================================
# API key for sending Craft's own platform emails (NOT user project emails).
# Get from: https://resend.com/api-keys (needs sending permission on your mail domain)
# The domain in RESEND_ACCOUNT_EMAIL_FROM must be verified in Resend dashboard.
# Display name is auto-added: "Craft <team@notifications.yourdomain.com>"
RESEND_ACCOUNT_API_KEY=re_xxxxxxxxxxxxxxxxxxxxxxxxxxxx
RESEND_ACCOUNT_EMAIL_FROM=team@notifications.yourdomain.com

# Cloudflare R2 Storage Configuration
# Get credentials from Cloudflare Dashboard > R2 > Manage R2 API Tokens
CLOUDFLARE_R2_ACCOUNT_ID=your-cloudflare-account-id
CLOUDFLARE_R2_ACCESS_KEY_ID=your-r2-access-key-id
CLOUDFLARE_R2_SECRET_ACCESS_KEY=your-r2-secret-access-key
CLOUDFLARE_R2_BUCKET_NAME=craft-files
CLOUDFLARE_R2_PUBLIC_URL=https://files.yourdomain.com # Optional: Custom domain for R2 bucket

# Upstash Redis Configuration (for rate limiting and webhook queue)
# Get credentials from: https://console.upstash.com/redis
UPSTASH_REDIS_REST_URL=your_upstash_redis_rest_url
UPSTASH_REDIS_REST_TOKEN=your_upstash_redis_rest_token

# Cron Job Security
CRON_SECRET=your-random-secret-for-cron-jobs

# Prisma Query Logging
PRISMA_QUERY_LOGS="false"

# Verbose Logging (set to "true" to enable debug logs in production)
VERBOSE_LOGGING="false"

# Environment Variable Encryption
# Generate a secure 32-byte key for AES-256 encryption
# In production, use: openssl rand -hex 32
# This key is used to encrypt secret environment variables stored in the database
ENV_VAR_ENCRYPTION_KEY=your-32-byte-encryption-key-change-in-production

# ============================================================================
# DEPLOYMENT MODE
# ============================================================================
# Controls how the Craft instance operates:
# - "self-hosted" — Community/OSS deployment (no billing, BYOK, full access) [DEFAULT]
# - "cloud"       — Standard SaaS (billing, subscriptions, credit system)
# - "enterprise"  — Managed dedicated instance by Nextcrafter (no billing, SSO, branding)
# See knowledge/plans-and-deployment-modes.md for full documentation
NEXT_PUBLIC_DEPLOYMENT_MODE=self-hosted

# ============================================================================
# BILLING (Only needed in "cloud" deployment mode)
# ============================================================================
# These are only needed if you're running the cloud SaaS with billing.
# For enterprise deployments, leave these empty.

# =============================================================================
# DODO PAYMENTS (Payment Processing)
# =============================================================================
# Dodo Payments handles all billing, checkout, and tax invoicing
# Get credentials from: https://dashboard.dodopayments.com
# Docs: https://docs.dodopayments.com
# =============================================================================

# Dodo Payments API Key (from dashboard > API Keys)
DODO_PAYMENTS_API_KEY=your-dodo-payments-api-key

# Dodo Payments Webhook Secret (from dashboard > Webhooks)
DODO_PAYMENTS_WEBHOOK_KEY=your-dodo-webhook-secret

# Dodo Payments Environment: "test_mode" or "live_mode"
DODO_PAYMENTS_ENVIRONMENT=test_mode

# Public environment flag for client-side checkout SDK
# Checkout SDK mode: "test" or "live"
NEXT_PUBLIC_DODO_ENVIRONMENT=test

# Dodo Balance Product ID (create a product in dashboard for balance top-ups)
DODO_BALANCE_PRODUCT_ID=your-balance-product-id

# Monthly Subscription Product IDs (create products in dashboard for each plan)
DODO_SUBSCRIPTION_HOBBY_MONTHLY_ID=your_hobby_product_id
DODO_SUBSCRIPTION_PRO_MONTHLY_ID=your_pro_product_id
DODO_SUBSCRIPTION_MAX_MONTHLY_ID=your_max_product_id

# Annual Subscription Product IDs (create in Dodo dashboard with yearly billing interval)
DODO_SUBSCRIPTION_HOBBY_ANNUAL_ID=pdt_xxx  # Hobby plan - $120/year
DODO_SUBSCRIPTION_PRO_ANNUAL_ID=pdt_xxx    # Pro plan - $600/year  
DODO_SUBSCRIPTION_MAX_ANNUAL_ID=pdt_xxx    # Max plan - $3000/year

# PostHog Analytics (optional)
# Get your project API key from: https://posthog.com (Settings > Project > Project API Key)
NEXT_PUBLIC_POSTHOG_KEY=your-posthog-api-key
NEXT_PUBLIC_POSTHOG_HOST=https://us.i.posthog.com

# =============================================================================
# MANAGED SERVICES (Auto-provisioned by Craft for user projects)
# =============================================================================
# These services are auto-provisioned by the AI agent when projects need them.
# Craft acts as a proxy — users pay at-cost with zero markup.
# Management keys below are REQUIRED for the provisioning to work.
# =============================================================================

# -----------------------------------------------------------------------------
# Neon Database (Serverless PostgreSQL)
# -----------------------------------------------------------------------------
# Management API for provisioning per-project Postgres databases
# Get API key from: https://console.neon.tech/app/settings/api-keys
#
# Default setup — works for self-hosted, enterprise.
# One org-level API key covers everything (no plan-based routing).
NEON_API_KEY=your_neon_org_api_key
NEON_DEFAULT_REGION=aws-us-east-1
NEON_ORG_ID=your_neon_organization_id

# Agent Plan — Two-Org Setup (REQUIRED for cloud deployment mode)
# Cloud deployments MUST use Neon's Agent Plan with two separate orgs:
#   free/hobby users → free sponsored org ($0 compute, Neon pays)
#   pro/max users   → paid org ($0.106/CU-hr, billed to Craft)
# Projects transfer automatically on plan upgrades/downgrades.
# Apply at: https://neon.com/use-cases/ai-agents
#
# Key scope:
#   NEON_FREE_ORG_API_KEY  — org-level key scoped to the free org only
#   NEON_PAID_ORG_API_KEY  — org-level key scoped to the paid org only
#   NEON_PERSONAL_API_KEY  — personal key (only key type that can transfer across orgs)
#   NEON_API_KEY above     — kept as fallback for self-hosted/enterprise; not used in cloud
NEON_FREE_ORG_API_KEY=your_free_org_api_key
NEON_PAID_ORG_API_KEY=your_paid_org_api_key
NEON_PERSONAL_API_KEY=your_personal_api_key
NEON_FREE_ORG_ID=your_free_sponsored_org_id
NEON_PAID_ORG_ID=your_paid_org_id
# Set to "true" if the respective org is on the Neon Agent Plan.
# Agent Plan unlocks features like configurable suspend_timeout_seconds.
# In two-org mode: set each flag independently (e.g. paid org upgraded, free org still free).
# In single-org mode: use NEON_AGENT_PLAN instead.
NEON_FREE_ORG_AGENT_PLAN=false
NEON_PAID_ORG_AGENT_PLAN=true
# Single-org mode Agent Plan flag (only used when NEON_FREE_ORG_ID / NEON_PAID_ORG_ID are NOT set)
NEON_AGENT_PLAN=false

# -----------------------------------------------------------------------------
# Resend Email (Managed email for user projects — proxy + custom domain)
# -----------------------------------------------------------------------------
# Management API key for provisioning per-project email sending.
# MUST have "Full access" scope (not just sending) — needed to create domains,
# API keys, and send on behalf of user projects via the email proxy.
# Get from: https://resend.com/api-keys → Create API Key → Full access
# Without this key: provisionEmailService AI tool will fail.
#
# CRAFT_MAIL_DOMAIN must be a verified domain in Resend (same account).
# This is the shared sending domain for all user projects (default mode).
# DNS records (DKIM, SPF) must be configured — check Resend dashboard.
RESEND_MANAGEMENT_API_KEY=re_xxxxxxxxxxxxxxxxxxxxxxxxxxxx
CRAFT_MAIL_DOMAIN=notifications.yourdomain.com

# -----------------------------------------------------------------------------
# Vercel AI Gateway (Per-project AI proxy — SEPARATE key required)
# -----------------------------------------------------------------------------
# STRICTLY SEPARATE gateway key for per-project AI proxy requests.
# Isolates user-project traffic from Craft's own platform AI usage.
# Get from: https://vercel.com/account/ai-gateway (create a second key)
# REQUIRED — no fallback to AI_GATEWAY_API_KEY. Both keys must be set.
AI_PROXY_GATEWAY_API_KEY=your_proxy_gateway_api_key
AI_PROXY_GATEWAY_BASE_URL=https://ai-gateway.vercel.sh/v1
# Public URL injected into user projects as AI_API_BASE_URL.
# In production, leave unset — falls back to NEXT_PUBLIC_APP_URL.
# In local dev, set this to your tunnel URL (ngrok/cloudflared) so sandbox
# projects can reach your local proxy: https://your-tunnel.ngrok.io
# AI_PROXY_PUBLIC_URL=

# -----------------------------------------------------------------------------
# VERCEL FOR PLATFORMS (Managed Deployment Infrastructure)
# -----------------------------------------------------------------------------
# Craft deploys user projects under its Vercel team
# Get token from: https://vercel.com/account/tokens
# Team ID: Get from team settings, starts with team_
PLATFORM_DEPLOY_TOKEN=your-vercel-access-token
PLATFORM_DEPLOY_TEAM_ID=team_xxxxxxxxxxxxxxxxxxxxx

# -----------------------------------------------------------------------------
# Upstash Redis (Managed Redis for user projects)
# -----------------------------------------------------------------------------
# Management API for provisioning per-project Redis databases
# Note: These are DIFFERENT from UPSTASH_REDIS_REST_* above (which are for Craft's own Redis)
# Get from: https://console.upstash.com/account/api
UPSTASH_API_EMAIL=your_upstash_account_email
UPSTASH_API_KEY=your_upstash_management_api_key
UPSTASH_DEFAULT_REGION=us-east-1

# -----------------------------------------------------------------------------
# R2 Storage (Managed Object Storage for user projects)
# -----------------------------------------------------------------------------
# R2 Provisioning (management API — NOT the S3 keys)
# Management token with R2:Edit
CLOUDFLARE_API_TOKEN=your-cloudflare-api-token
CLOUDFLARE_R2_ACCOUNT_ID=your-account-id