.env.example

# Production settings. They live in Infisical (project `janitor`, environment
# `production`, path `/`), which alchemy.run.ts loads for the production stage.
# Infisical overrides the shell. Leave optional keys out of Infisical entirely;
# an empty value counts as set. The `development` environment holds the subset
# `alchemy dev` uses: the development GitHub App's credentials and webhook
# secret, its OAuth client, the optional settings below, and
# CLOUDFLARE_TUNNEL_TOKEN for the webhook tunnel. Each is optional there.
#
# Two kinds of setting stay outside Infisical:
# - CLOUDFLARE_ACCOUNT_ID and CLOUDFLARE_API_TOKEN come from the shell (GitHub
#   environment `production` in CI, or an Alchemy profile locally).
# - Infisical's own login: INFISICAL_IDENTITY_ID in CI (GitHub OIDC), or
#   `alchemy profile edit --add Infisical` locally.

# Neon API key Alchemy uses to create and manage the database project.
NEON_API_KEY=CHANGE_ME
# Point-in-time restore window in seconds. Defaults to 604800 (seven days);
# select a Neon plan that supports the window.
NEON_HISTORY_RETENTION_SECONDS=21600

# GitHub login method in Cloudflare Zero Trust (effectful.cloudflareaccess.com).
CLOUDFLARE_ACCESS_GITHUB_IDP_ID=CHANGE_ME

# Production GitHub App.
GITHUB_APP_ID=CHANGE_ME
# PEM private key. Multiline values are fine in Infisical.
GITHUB_APP_PRIVATE_KEY="CHANGE_ME"
# Must match the webhook secret on the GitHub App.
GITHUB_WEBHOOK_SECRET=CHANGE_ME

# Optional. The GitHub App's OAuth client for connecting GitHub accounts. Both
# are required together. Register https://<domain>/account/github/return as a
# callback URL.
# GITHUB_OAUTH_CLIENT_ID=
# GITHUB_OAUTH_CLIENT_SECRET=

# Optional. The OpenRouter key; AI labeling rules evaluate to unknown until it is set.
# OPENROUTER_API_KEY=
# The OpenRouter decision model for AI labeling rules. Defaults to typesafe/jev-1.13.
# LABELING_AI_MODEL=
# Per-rule input byte budget including reserved framing (4,000–64,000). Defaults to 16000.
# LABELING_AI_INPUT_BYTES=
# Cache lifetime for all AI rules, in whole seconds. Defaults to 86400.
# LABELING_AI_CACHE_TTL_SECONDS=