# Server-only OpenAI access for the permission-gated ISAC mechanic and
# calculation authoring assistants. Use a project-scoped, Responses-only restricted key.
OPENAI_MECHANIC_API_KEY=
OPENAI_MECHANIC_MODEL=gpt-5.6-terra
OPENAI_MECHANIC_REASONING_EFFORT=medium
OPENAI_MODERATION_API_KEY=

# Local path used by the embedded @tursodatabase/database engine.
# Relative paths are resolved from the project directory. Development and
# production should always use different database files.
TDR_DATABASE_PATH=./data/shd-build-development.db

# Persistent directory for normalized user-uploaded avatars.
TDR_AVATAR_STORAGE_PATH=./data/avatars

# Persistent directory for uploaded talent, brand, protocol, and skill-chip icons.
TDR_GAME_ICON_STORAGE_PATH=./data/game-icons

# Optional fixed credentials used only when initializing or explicitly resetting
# the two default accounts. Leave blank to generate secure temporary passwords.
DEFAULT_ADMIN_PASSWORD=
DEFAULT_USER_PASSWORD=

# Discord OAuth2 application credentials.
DISCORD_CLIENT_ID=
DISCORD_CLIENT_SECRET=
# Proxied development: https://dev.shd.build/auth/discord/callback
# Production: https://shd.build/auth/discord/callback
DISCORD_REDIRECT_URI=https://dev.shd.build/auth/discord/callback

# Canonical application origin used in emailed authentication links.
APP_ORIGIN=https://dev.shd.build
# SvelteKit adapter-node canonical origin when deployed behind a reverse proxy.
ORIGIN=https://dev.shd.build
# Use shd.build for both production and dev.shd.build. Use localhost only when
# accessing development directly at http://localhost:5173.
PASSKEY_RP_ID=shd.build

# SMTP delivery for email verification and magic-link authentication.
# Port 465 normally uses SMTP_SECURE=true. Port 587 normally uses false and STARTTLS.
SMTP_HOST=
SMTP_PORT=587
SMTP_SECURE=false
SMTP_USER=
SMTP_PASSWORD=
SMTP_FROM=SHD.build <no-reply@shd.build>

# Long random bearer token used only by the internal container scheduler.
SCHEDULER_TOKEN=
REMOVE_BG_API_KEY=
REMOVE_BG_LOW_CREDIT_THRESHOLD=5
REMOVE_BG_LOW_FREE_CALL_THRESHOLD=10
REMOVE_BG_CREDIT_CHECK_HOURS=6