# ─────────────────────────────────────────────────────────────────────────
# WHAT BELONGS IN THIS FILE — and what does NOT
#
# This file is for the DEPLOYMENT'S OWN identity and its model keys. That is
# all. Provider credentials do NOT live here.
#
#   HERE, in .env
#     LEAFMESH_LICENSE_KEY, LEAFMESH_ENV_TOKEN
#     the ports, REDIS_* / Postgres  (the store the vault itself lives in)
#     your model provider key(s): OPENAI_API_KEY / ANTHROPIC_API_KEY /
#       GOOGLE_API_KEY …  (these are read from the environment as the mesh
#       starts, so they must be here — the vault is read too late for them)
#
#   NOT HERE — in the VAULT, added on Studio's Infrastructure page
#     every channel credential  (Slack bot_token / signing_secret / app_token,
#       Teams, Discord, Cliq, WhatsApp, Email)
#     every connector credential (MCP, Zapier, Composio, n8n, custom)
#     Config then names it:  connection: "slack-workspace"
#
# Why it matters: since 2.4.180 the mesh REFUSES TO BOOT if it finds a
# provider credential written into config — and `${ENV_VAR}` does not help,
# because substitution happens before the check runs, so the check sees the
# token itself. `connection:` is the only path that works.
#
# Note: a value is EMPTY here, never a comment. `KEY=   # explanation` is read
# by python-dotenv as the COMMENT being the value.
# ─────────────────────────────────────────────────────────────────────────

# {{project_name}} — environment template
LEAFMESH_LICENSE_KEY=

OPENAI_API_KEY=
ANTHROPIC_API_KEY=

REDIS_HOST=localhost
REDIS_PORT=6379
REDIS_PASSWORD=

# Webhook the human members (associate / senior / SME / lead / partner)
# notify via human_interface: webhook. Point it at your inbox / Studio
# adapter. Defaults to a local stub if unset.
# HITL_OUTBOUND_URL=http://127.0.0.1:9999/human-notify
#   ^ LOCAL TEST STUB ONLY. Leave it commented. A human seat should be
#     human_interface: "default" (the Studio Inbox) — a real queue a real
#     person clicks. A custom webhook receiver is not how HITL is run.

PAGER_WEBHOOK=
# SLACK_DELIVERY_CHANNEL is the channel_id the escalation `channel`
# target posts to (configs/config.yaml manager.escalation.targets).
SLACK_DELIVERY_CHANNEL=
# SLACK_BOT_TOKEN / SLACK_SIGNING_SECRET are fields of a `channels:
# {slack: {...}}` block (ChannelConfig) — they are NOT auto-consumed by
# the escalation channel target. Add a channels: block to configs/
# config.yaml to actually deliver Slack messages, then these apply.
SLACK_BOT_TOKEN=
SLACK_SIGNING_SECRET=

# ── Dev store ──
# The full chain runs day-0 on Tier 1 alone against a seeded dev store
# (agency/_shared/store.py, JSON under ./data/) — a brief, research corpus,
# client account context and prior deliverables for one realistic
# engagement. In production, replace each store read/write with the
# matching connector call (CRM / KB / deliverables archive / PSA); the
# function signatures are the contract. The vars below front those
# systems but setting them alone does nothing until store.py is wired.

# PSA connectors — n8n workflows fronting YOUR systems of record.
# Hours/utilisation: Harvest, Toggl, ClickTime, Tempo, Kantata, ...
PSA_TIMESHEET_WEBHOOK_URL=
PSA_TIMESHEET_AUTH_TOKEN=
# Engagement sweep: your PSA / project tracker (Kantata, Asana, Jira, ...)
# The weekly sweep runs day-0 on the seed backlog; these only matter once
# you swap claim_next_active_engagement's body for your PSA query.
PSA_STATUS_SWEEP_WEBHOOK_URL=
PSA_STATUS_SWEEP_AUTH_TOKEN=

# KB / RAG for research_agent. Set this, then UNCOMMENT the mcp: block on
# research_agent in configs/config.yaml (an empty-url mcp block is rejected
# at load, so it ships commented).
KB_MCP_URL=
KB_MCP_TOKEN=

LEAFMESH_ENV_TOKEN=development
