.env.example

# DocuScan environment — copy to .env.local and fill in for production.
# With none of these set, the app uses in-memory stores (fine for local dev).

# --- Redis (Upstash) — shared state across instances ---
# Backs rate limiting, guest usage limits, feedback, referral, billing/usage
# metering, developer API keys, AND share links (lib/share.ts) when S3 is unset.
# Must be these exact names — a Vercel/Upstash integration may instead set
# KV_REST_API_URL / KV_REST_API_TOKEN, which the enable-checks DON'T read.
# Verify via GET /api/health → "usageRedis": true.
UPSTASH_REDIS_REST_URL=
UPSTASH_REDIS_REST_TOKEN=

# --- Share-link object storage (Cloudflare R2 / S3) ---
# Takes precedence over Redis for share-link storage (objectStoreBackend() in
# lib/share.ts). Recommended for production: keeps large PDFs out of Redis and
# the bucket private (the API route proxies downloads). Without it, share links
# fall back to Redis (if set) or in-memory (dev only — lost on cold start).
S3_ENDPOINT=
S3_REGION=
S3_BUCKET=
S3_ACCESS_KEY_ID=
S3_SECRET_ACCESS_KEY=

# --- Expired-file cleanup cron ---
# Secret guarding GET/POST /api/cron/cleanup. If unset, the endpoint is DISABLED
# (returns 503) so it can never run anonymously. Set it, then schedule the URL:
#   Vercel Cron (vercel.json):  { "path": "/api/cron/cleanup", "schedule": "0 3 * * *" }
#   (Hobby plan allows daily crons only; use a tighter interval on Pro.)
#   External pinger:            Authorization: Bearer <secret>  (or ?key=<secret>)
CRON_SECRET=

# Rate limiting + feedback storage reuse the Redis vars above when present
# (otherwise in-memory). No extra config needed.

# --- Site URL (SEO: canonical, OG, sitemap, robots) ---
# Your production origin, no trailing slash. Falls back to https://docuscan.app.
NEXT_PUBLIC_SITE_URL=

# --- Analytics (PostHog) ---
# When set, components/Analytics.tsx loads PostHog from its CDN AFTER the user
# accepts the cookie banner. Unset = no analytics, no banner. NEXT_PUBLIC_ so it
# reaches the browser; the key is a write-only project key (safe to expose).
NEXT_PUBLIC_POSTHOG_KEY=
NEXT_PUBLIC_POSTHOG_HOST=https://us.i.posthog.com

# --- Error tracking (Sentry) ---
# NEXT_PUBLIC_SENTRY_DSN: client errors via Sentry's browser Loader (CDN), also
#   consent-gated. SENTRY_DSN: server-side seam in instrumentation.ts (needs
#   @sentry/nextjs to actually forward — see the file).
NEXT_PUBLIC_SENTRY_DSN=
SENTRY_DSN=

# --- AI document features (provider-agnostic) ---
# Powers all AI tools via /api/ai: /smart (name/tag/extract), /reconstruct
# (make editable), /chat (streamed), /redact (PII), /translate, /compare.
# Set EITHER provider's key (or both). Unset both = AI tools return 503.
# Server-side only (secret). Document text is always extracted in the browser
# first — the raw file never leaves the device.
#
# Provider selection: AI_PROVIDER forces one; otherwise Anthropic wins if its
# key is set, else OpenAI. Leave blank to auto-pick.
AI_PROVIDER=
# Anthropic Claude (default) — model claude-opus-4-8.
ANTHROPIC_API_KEY=
# OpenAI (ChatGPT) — set OPENAI_MODEL to the exact model id you have access to
# (default "gpt-5.5"; override if the API rejects it).
OPENAI_API_KEY=
OPENAI_MODEL=gpt-5.5

# --- White-label branding (build-time, NEXT_PUBLIC_) ---
# Re-skin the app per deployment. Unset = "DocuScan" defaults.
NEXT_PUBLIC_BRAND_NAME=
NEXT_PUBLIC_BRAND_TAGLINE=

# --- High-fidelity Office conversion (optional) ---
# Most conversions in /convert run in the browser. For pixel-perfect Office ↔ PDF
# (DOCX/PPTX/XLSX), point this at a self-hosted converter — e.g. Gotenberg
# (https://gotenberg.dev) or a LibreOffice/unoconv service. Unset = those targets
# return 503 (the browser conversions still work). See app/api/convert/route.ts.
CONVERT_SERVICE_URL=
CONVERT_SERVICE_TOKEN=

# --- Developer API key admin + cloud save (optional) ---
# ADMIN_API_SECRET gates POST/GET /api/keys (issue/list developer keys).
ADMIN_API_SECRET=
# Dropbox Saver (client drop-in; functional with just the app key):
NEXT_PUBLIC_DROPBOX_APP_KEY=
# Google Drive save is an OAuth seam (button appears; flow still to be wired):
NEXT_PUBLIC_GOOGLE_CLIENT_ID=

# --- Tools expansion (Smart Notes, Templates, Invoice Maker, Print Ready,
#     QR Labels, Resume Scanner, Receipt Scanner, Reminders) ---
# These tools need NO new environment variables. They run in the browser and
# persist "saved" data (templates, invoices, expenses, reminders, QR labels) in
# localStorage. The AI-backed ones (Resume Scanner, Receipt Scanner, Smart Notes
# AI actions) reuse ANTHROPIC_API_KEY / OPENAI_API_KEY above — no key = the AI
# action returns 503, the non-AI parts still work.